CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
Apache CXF attachment header limits can be bypassed, allowing denial of service via memory exhaustion.
Apache CXF's multipart and MTOM attachment-header parser did not fully enforce attachment-max-header-size (default 300 characters) or attachment-headers-max-count (default 500). CVE-2026-107937 applied the size limit only to each physical line, not to a header value assembled from multiple lines, allowing denial of service through memory exhaustion. Apache rates it low. The same branches are affected as the related CXF fixes: before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4.
- Multipart header parser enforced the size limit only per physical line.
- Defaults are 300 characters and 500 headers, but both can be bypassed.
- Apache rates the memory-exhaustion denial of service as low.
- Fixes ship in CXF 3.6.13, 4.1.9, and 4.2.4.
- CVEs
- CVE-2026-107937
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107937 | Apache CXF multipart header-limit bypass enables unauthenticated DoS | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: low Affected versions: - Apache CXF 4. 2. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.