Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-12 | 2 | Disclosure2 |
| 2026-08-06 | 3 | Disclosure3 |
CVE-2026-64958 An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment hea… https://www.cve.org/CVERecord?id=CVE-2026-64958
Post summary
The post reports that CVE-2026-64958 still causes a denial‑of‑service on Apache CXF due to an incomplete fix of CVE-2026-50645, but provides no PoC, exploit code, or evidence of widespread attacks.
🚨*CVE* CVE-2026-64958 An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment hea… https://www.cve.org/CVERecord?id=CVE-2026-64958 ----- Traducción: CVE-2026-64958 Una… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑64958, noting that an incomplete fix for CVE‑2026‑50645 leaves Apache CXF vulnerable to DoS via messages with many attachment headers – no PoC, exploit code, or evidence of active exploitation is presented.
CVE-2026-64958 Denial of Service in Apache CXF via Multiple Attachment Headers CVE-2026-50645 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64958
Post summary
The note lists CVE-2026-64958 and CVE-2026-50645, provides a link to a vulnerability details site, and briefly mentions a DoS issue in Apache CXF, but offers no PoC, exploit code, patch, or active exploitation information.
CVE-2026-50645 There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource … https://www.cve.org/CVERecord?id=CVE-2026-50645
Post summary
The post announces CVE‑2026‑50645, highlighting an unbounded attachment header issue in Apache CXF that can lead to uncontrolled resource usage, but it provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-50645 Denial of Service via Unrestricted Attachment Headers in Apache C... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50645 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A brief announcement of a new DoS vulnerability (CVE-2026-50645) affecting Apache, with no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cxf | - | - | - |