CVE-2026-107937

7.5 HIGH

Published 2026-10-09 · Updated 2026-10-15

AI risk analysis

Summary: Apache CXF's multipart/MTOM parser fails to properly enforce attachment header size and count limits, allowing unauthenticated attackers to cause unbounded memory allocation through crafted multipart requests that use folded or repeated headers.
Exploitability: Exploitation is straightforward for remote attackers with no authentication requirements, as they only need to send a specially crafted multipart request with large folded or repeated headers to trigger the memory exhaustion vulnerability.
Blast radius: The vulnerability could impact any Apache CXF service handling multipart/MTOM attachments, potentially causing widespread denial of service across affected web services and applications using the framework.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this memory exhaustion vulnerability.

doswebxmlcxf

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-770

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.