CVE-2026-50645
Fixed in a distro release EPSS <1%CVSS 7.5
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Products: Apache Software Foundation Apache CXF
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.cxf:cxf-core | 4.2.2 |
| Maven | org.apache.cxf:cxf-core | 4.1.7 |
| Maven | org.apache.cxf:cxf-core | 3.6.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-tika-2.9 | 2.9.4-r20 |
| Chainguard | apache-tika-3.0 | 3.0.0-r31 |
| Chainguard | apache-tika-3.1 | 3.1.0-r38 |
| Chainguard | apache-tika-3.2 | 3.2.3-r18 |
| Chainguard | apache-tika-3.2-compat | 3.2.3-r18 |
| Chainguard | apache-tika-3.3 | 3.3.2-r2 |
| Chainguard | apache-tika-fips-2.9 | 2.9.4-r12 |
| Chainguard | apache-tika-fips-3.0 | 3.0.0-r13 |
| Chainguard | apache-tika-fips-3.1 | 3.1.0-r15 |
| Chainguard | apache-tika-fips-3.2 | 3.2.3-r13 |
| Chainguard | apache-tika-fips-3.3 | 3.3.2-r4 |
| Chainguard | wso2is | 7.3.0-r3 |
| Chainguard | wso2is | no fix |
| Wolfi | apache-tika-3.1 | 3.1.0-r38 |
| Wolfi | apache-tika-3.2 | 3.2.3-r18 |
| Wolfi | apache-tika-3.2-compat | 3.2.3-r18 |
| Wolfi | apache-tika-3.3 | 3.3.2-r2 |