CVE-2026-64958

CVE-2026-64958: Apache CXF: Denial of service via message header attachments

Vendor Apache Software Foundation

Product Apache CXF

Weakness CWE-400

Published August 6, 2026

Last update August 6, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Key dates

02Disclosure timeline

August 6, 2026 CVE published

August 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-64958 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/400.html AskarLabs — CWE-400 write-up Uncontrolled Resource Consumption

Related vulnerabilities

Identifiers

CVE CVE-2026-64958

CWE CWE-400

Affected versions

Vendor Apache Software Foundation

Product Apache CXF

Affected ≥ 4.2.0 and < 4.2.3

Vendor Apache Software Foundation

Product Apache CXF

Affected ≥ 4.0.0 and < 4.1.8

Vendor Apache Software Foundation

Product Apache CXF

Affected < 3.6.12

CVE-2026-64958: Apache CXF: Denial of service via message header attachments

01Description

02Disclosure timeline

03References

04Related CVE