CVE-2026-107937: apache software foundation apache cxf

Vulnerability summary

CVE-2026-107937 is a high (CVSS 7.5) vulnerability in apache software foundation apache cxf. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.