CVE-2026-64958 Overview
CVE-2026-64958 is a denial of service vulnerability in Apache CXF caused by an incomplete fix for the earlier CVE-2026-50645. Attackers can exhaust server resources by sending a single message containing many attachment headers. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption and affects Apache CXF releases prior to the patched versions.
Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and JAX-WS/JAX-RS web services on Java. Any service that accepts multipart or attachment-bearing messages inherits the exposure.
Critical Impact
Remote unauthenticated attackers can send crafted messages with many attachment headers to trigger resource exhaustion, degrading or disabling Apache CXF services.
Affected Products
- Apache CXF versions prior to 4.2.3 in the 4.2.x branch
- Apache CXF versions prior to 4.1.8 in the 4.1.x branch
- Apache CXF versions prior to 3.6.12 in the 3.6.x branch
Discovery Timeline
- 2026-08-06 - CVE-2026-64958 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64958
Vulnerability Analysis
The vulnerability resides in how Apache CXF processes attachment headers on incoming messages. An earlier fix for CVE-2026-50645 attempted to bound the cost of parsing large numbers of attachment headers. That fix was incomplete, leaving a path for attackers to force the server into expensive header processing.
An adversary who can reach an Apache CXF endpoint can submit a single message containing an unbounded or very large number of attachment headers. Parsing this message consumes CPU and memory disproportionate to the request size. Repeated requests amplify the effect and can render the service unresponsive to legitimate clients.
Because CXF is commonly exposed as a public web services layer, the attack requires no authentication in typical deployments and needs only network reach to the service endpoint.
Root Cause
The root cause is uncontrolled resource consumption during attachment header parsing [CWE-400]. The prior remediation for CVE-2026-50645 did not fully constrain the number or cost of attachment headers processed per message, so an attacker can still drive the parser into a resource-exhausting state.
Attack Vector
The attack vector is network-based. An attacker sends a specially crafted SOAP or MIME multipart message containing an excessive number of attachment headers to any reachable Apache CXF endpoint. No user interaction or credentials are required in typical service configurations.
No verified public exploit code is available at this time. See the Apache Security Mailing List Update for the vendor's technical description.
Detection Methods for CVE-2026-64958
Indicators of Compromise
- Inbound SOAP or multipart HTTP requests containing an unusually large count of MIME headers per attachment part.
- Sudden spikes in CPU and heap usage on JVMs hosting Apache CXF endpoints, correlated with inbound multipart traffic.
- Increased HTTP 5xx responses, request timeouts, or thread pool exhaustion in CXF-backed services.
Detection Strategies
- Inspect HTTP request bodies at the application gateway or WAF for multipart messages whose per-part header count exceeds a reasonable threshold.
- Correlate CXF servlet request latency with JVM garbage collection pauses and thread pool saturation to identify parser-driven exhaustion.
- Baseline normal attachment header counts per client and alert on statistical outliers.
Monitoring Recommendations
- Enable verbose logging on the CXF attachment interceptor and track parse durations per request.
- Export JVM metrics (heap, CPU, thread count) to your SIEM and alert on sustained saturation of CXF worker threads.
- Monitor upstream reverse proxy logs for repeated large multipart POST requests from the same source.
How to Mitigate CVE-2026-64958
Immediate Actions Required
- Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the branch in use.
- Inventory all applications embedding CXF, including transitive dependencies pulled in by Spring Boot starters and other frameworks.
- Restrict network exposure of CXF endpoints to trusted clients where feasible until patching is complete.
Patch Information
Apache has released fixed versions 4.2.3, 4.1.8, and 3.6.12, which properly bound attachment header processing. Refer to the Apache Security Mailing List Update for release details and upgrade notes.
Workarounds
- Place a reverse proxy or WAF in front of CXF endpoints and reject multipart requests whose per-part header count or total header size exceeds a conservative threshold.
- Enforce request size and connection rate limits at the ingress layer to blunt repeated exhaustion attempts.
- Disable attachment support on CXF endpoints that do not require it by configuring the relevant interceptors to reject multipart payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
