CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing
Apache MyFaces fixes critical CVE-2026-76646, a remote denial-of-service flaw triggered by crafted request parameters across versions 2.2.0-4.1.3.
Apache MyFaces disclosed CVE-2026-76646, a critical denial-of-service vulnerability in which remote attackers can cause excessive resource consumption by supplying specially crafted request parameters. Affected versions span 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3 and 2.3-next-*. The disclosure notes older versions may also be impacted.
- Remote attackers can trigger excessive resource consumption and denial of service via crafted request parameters.
- Severity rated critical by Apache; affects MyFaces releases from 2.2.0 through 4.1.3.
- Older versions may also be affected; unbounded request parsing is the root cause.
- CVEs
- CVE-2026-76646
- Vendors
- Apache
- Products
- Apache MyFaces
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76646 | Denial of Service via Unbounded Request Parameter Parsing in Apache MyFaces | 7.5 | — |
From the original article
Posted by Volodymyr Siedlecki on Sep 16 Severity: critical Affected versions: - Apache MyFaces 2. 2. 0 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.