{"id":"CVE-2026-107937","published":"2026-10-09T11:17:02.107","lastModified":"2026-10-15T18:17:24.767","description":"In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. \nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/x9twtpv3d04qj83t6w9xkh9y2q28zztj","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/12","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache CXF's multipart/MTOM parser fails to properly enforce attachment header size and count limits, allowing unauthenticated attackers to cause unbounded memory allocation through crafted multipart requests that use folded or repeated headers.","exploitability":"Exploitation is straightforward for remote attackers with no authentication requirements, as they only need to send a specially crafted multipart request with large folded or repeated headers to trigger the memory exhaustion vulnerability.","blast_radius":"The vulnerability could impact any Apache CXF service handling multipart/MTOM attachments, potentially causing widespread denial of service across affected web services and applications using the framework.","remediation":"Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this memory exhaustion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","web","xml","cxf"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:02:40.315Z"}}