CVE-2026-4249: The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and…

PriorityP354high8.6CVSS 3.1

AVNACLPRNUINSCCNINAH

EPSS

0.56%

45.2th percentile

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

Affected

32 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	api_control_plane	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	api_manager	>= 4.0.0 < 4.0.0.390	4.0.0.390
wso2	api_manager	>= 4.1.0 < 4.1.0.254	4.1.0.254
wso2	api_manager	>= 4.2.0 < 4.2.0.194	4.2.0.194
wso2	api_manager	>= 4.3.0 < 4.3.0.105	4.3.0.105
wso2	api_manager	>= 4.4.0 < 4.4.0.69	4.4.0.69
wso2	api_manager	>= 4.5.0 < 4.5.0.54	4.5.0.54
wso2	api_manager	>= 4.6.0 < 4.6.0.18	4.6.0.18
wso2	traffic_manager	>= 4.5.0 < 4.5.0.53	4.5.0.53
wso2	traffic_manager	>= 4.6.0 < 4.6.0.18	4.6.0.18
wso2	universal_gateway	>= 4.5.0 < 4.5.0.54	4.5.0.54
wso2	universal_gateway	>= 4.6.0 < 4.6.0.18	4.6.0.18
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	wso2_api_control_plane	>= 4.7.0 < 4.7.0.2	4.7.0.2
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.470	3.2.0.470
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.89	3.2.1.89
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.390	4.0.0.390
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.254	4.1.0.254
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.194	4.2.0.194
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.105	4.3.0.105
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.69	4.4.0.69
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.54	4.5.0.54
wso2	wso2_api_manager	>= 4.6.0 < 4.6.0.18	4.6.0.18

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.