CVE-2026-107937: In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters)…

PriorityP345high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.56%

46.1th percentile

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
apache	cxf	< 3.6.13	3.6.13
apache	cxf	>= 4.0.0 < 4.1.9	4.1.9
apache	cxf	>= 4.2.0 < 4.2.4	4.2.4
apache_software_foundation	apache_cxf	< 3.6.13	3.6.13
apache_software_foundation	apache_cxf	>= 4.0.0 < 4.1.9	4.1.9
apache_software_foundation	apache_cxf	>= 4.2.0 < 4.2.4	4.2.4
jboss-eap-7	eap74-els-openjdk11-openshift-rhel8	—	—
jboss-eap-7	eap74-els-openjdk17-openshift-rhel8	—	—
jboss-eap-7	eap74-els-openjdk8-openshift-rhel8	—	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.