Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-107937] In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits

This security Apache Software Foundation advisory covers CVE-2026-107937; related products: Apache CXF.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-107937 Source published Source updated

VulniPulse record published Record updated

CVE-2026-107937
Related products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits.

The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines.

A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service.

Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected versions
  • Apache CXF 4.2.0 before 4.2.4
  • Apache CXF 4.0.0 before 4.1.9
  • Apache CXF before 3.6.13

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Fixed versions
  • 4.2.4
  • 4.1.9
  • 3.6.13

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header.
  • The count limit was checked against the number of distinct header names, not the total number of header lines.
  • Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.