Vulnerability in Apache Software Foundation Apache CXF

[ Description ]Official description

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service.  Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3824

  Apache CXF: Multiple vulnerabilities Translated from German

  CVE-2026-78384CVE-2026-97791CVE-2026-108039+7 more CVEs

[ References ]References

• lists.apache.org/thread.html/x9twtpv3d04qj83t6w9xkh9y2q28zztjIssue TrackingVendor AdvisoryMailing List
• www.openwall.com/lists/oss-security/2026/10/09/12Mailing ListThird Party Advisory