GHSA-ghvc-7hp8-2g2v
Suggest an improvement- Source
- https://github.com/advisories/GHSA-ghvc-7hp8-2g2v
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ghvc-7hp8-2g2v/GHSA-ghvc-7hp8-2g2v.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-ghvc-7hp8-2g2v
- Aliases
- Downstream
- Published
- 2026-06-12T12:31:34Z
- Modified
- 2026-09-10T03:50:49Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Apache cxf-core: No restriction on attachment headers per message
- Details
-
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Database specific
{ "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2026-08-06T19:12:38Z", "nvd_published_at": "2026-06-12T10:16:23Z", "severity": "HIGH" }- References
Affected packages
Maven / org.apache.cxf:cxf-core
Package
- Name
- org.apache.cxf:cxf-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.cxf/cxf-core
Maven / org.apache.cxf:cxf-core
Package
- Name
- org.apache.cxf:cxf-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.cxf/cxf-core
Maven / org.apache.cxf:cxf-core
Package
- Name
- org.apache.cxf:cxf-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.cxf/cxf-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.6.12
Affected versions
3.*
3.0.0-milestone1
3.0.0-milestone2
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.3.10
3.3.11
3.3.12
3.3.13
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.4.10
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.5.11
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.6.10
3.6.11