CVE-2026-50645: Apache CXF: No restriction on attachment headers per message

Synopsis

An uncontrolled resource consumption vulnerability affects Apache CXF versions prior to 4.1.7 and 4.2.0 through earlier than 4.2.2. The flaw is reachable over the network without any authentication, and stems from no upper limit on the number of attachment headers that CXF will process when deserializing an incoming message. A remote attacker can exploit this by sending a crafted request with an excessive number of attachment headers, exhausting server resources and causing a denial of service. Patched-image rebuilds at versions 4.1.7 and 4.2.2 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization path is exposed over the network, so an attacker must be able to send HTTP or SOAP requests to the CXF service endpoint.

• AuthenticationNot required

  No credentials or session token are needed; the malicious attachment header payload can be submitted by any unauthenticated caller.

• Victim interactionNot required

  No user action or social engineering is required; the attacker sends a crafted request directly to the server.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or special environmental setup beyond network access to the service.

Blast Radius

• The affected service exhausts available memory or CPU processing time while parsing unbounded attachment headers, crashing or hanging the CXF process.
• Legitimate clients lose access to any functionality hosted by the affected CXF endpoint for the duration of the attack.
• Depending on deployment topology, resource exhaustion on a shared host can degrade or bring down co-located services that share the same JVM or container.