An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
| Vendor | Product | Versions |
|---|---|---|
| apache | cxf | 4.2.0, 4.0.0, 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| apache | cxf | cert_advisory | 90% |
| realobjects | pdfreactor | cert_advisory | 90% |
