CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing
Apache MyFaces fixes critical CVE-2026-76646, a remote denial-of-service flaw triggered by crafted request parameters across versions 2.2.0-4.1.3.
45
Vulnerability1 · 1 read
CVE-2026-76646
Denial of Service via Unbounded Request Parameter Parsing in Apache MyFaces
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache MyFaces, the open-source Java/Jakarta Faces implementation maintained by the Apache Software Foundation, contains an uncontrolled resource consumption flaw (CWE-400) in its request processing. A remote attacker can trigger the condition without authentication by supplying specially crafted request parameters, causing the application to consume excessive resources and potentially denying service to legitimate users. All supported MyFaces release branches prior to the fixed versions are affected, and older, unsupported versions may also be vulnerable. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known at this time.
What to do: Upgrade MyFaces to the fixed release for your branch: 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, and check application WAR/EAR dependencies (or TomEE distributions) for bundled MyFaces JARs, since the library is typically inherited transitively. For deployments on older unsupported versions, plan a migration to a supported fixed branch. As interim mitigation, front-facing applications can apply reverse-proxy or WAF rate limiting and request-parameter size/count limits to blunt resource-exhaustion attempts.
| Product | Affected |
|---|---|
| Apache MyFaces | 2.3.x prior to 2.3.12 |
| Apache MyFaces | 2.3-next prior to 2.3-next-M9 |
| Apache MyFaces | 3.0.x prior to 3.0.4 |
| Apache MyFaces | 4.0.x prior to 4.0.4 |
| Apache MyFaces | 4.1.x prior to 4.1.4 |
| Apache MyFaces | Older unsupported versions may also be affected |
Estimated exposure
largelikely tens of thousands of Java web application deployments worldwide; exact count unknown — MyFaces is a library embedded in customer web applications (including as the default Faces implementation in Apache TomEE) rather than a standalone product, so there is no public install or internet-exposure telemetry, but its broad…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
- Weakness
- CWE-400
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H