CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
Apache CXF attachment header limits can be bypassed, allowing denial of service via memory exhaustion.