apache__myfaces_CVE-2011-4367_2-0-11

Apache's implementation of the JavaServer Faces JSF and Jakarta Faces specification Branches main Jakarta Faces 5.0 implementation 4.1.x Jakarta Faces 4.1 implementation 4.0.x Jakarta Faces 4.0 implementation Based on the refactored 2.3-next codebase 2.3-next Almost JavaServer Faces 2.3...

CVE-2026-68536

A flaw was found in Apache MyFaces Core. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF, which can trick the server into making requests to arbitrary domains, potentially accessing internal resources. Additionally, Local File Inclusion LFI is possible,...

org.apache.myfaces.core:myfaces-core-assembly (>=3.0.0, <=3.0.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=3.0.0, <=3.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =3.0.0, =3.0.0, =3.0.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

CVE-2026-76646 Apache MyFaces: Denial of Service via Unbounded Request Parsing

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

cloud.piranha.extension:piranha-extension-myfaces (>=21.6.0, <=22.8.0), cloud.piranha.faces:piranha-faces-myfaces (>=21.3.0, <=21.5.0) +27 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=3.0.0, <=3.0.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =3.0.0, =21.6.0, =21.3.0, =22.3.0, =9.0.0.final, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =3.2.0, =3.0.0, =3.0.0, =3.0.0, =9.0.0-m8, =9.0.0-m8, =9.0.0-m8, =9.0.0-m8, =9.0.0-m8, =9.1.3 and more Source cves: CVE-2026-76646 Source advisory:...

CVE-2026-76646 Apache MyFaces: Denial of Service via Unbounded Request Parsing

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3-next-m1, <=2.3-next-m8) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=4.0.0, <=4.0.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=4.0.0, <=4.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3.1, <=2.3.11) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3.1, =2.3.1, =2.3.11 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

CVE-2026-76646

The Apache MyFaces framework is vulnerable to a Denial of Service (DoS) condition due to unbounded request parsing . A remote attacker can trigger excessive resource consumption by providing specially crafted request parameters. To remediate this issue, users are recommended to upgrade to version...

org.apache.myfaces.core:myfaces-core-assembly (>=4.1.0, <=4.1.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

cloud.piranha.faces:piranha-faces-myfaces (>=19.12.0, <=20.12.0), com.liferay.faces:primefaces-integration-tests (>=13.0.10.liferay-patched-1, <=15.0.6.liferay-patched-1) +58 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3.1, =19.12.0, =13.0.10.liferay-patched-1, =4.0.15.0, =4.0.9.0, =8.0.0.final, =1.7.2.230613, =1.7.2.230622, =3.1.0, =2.3.1, =2.3.1, =2.3.1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.15.2 and more Source cves:...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.2, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.2, <=5.5.1) +25 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0, =4.6.2, =4.6.2, =3.15.0, =3.15.0, =3.15.0, =3.15.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 - org.apache.tomee:apache-tomee...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-76646 Sou...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3.1, <=2.3.11) potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-bundle (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3.1, =2.3.1, =2.3.11 Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

cloud.piranha.faces:piranha-faces-myfaces (>=19.12.0, <=20.12.0), com.liferay.faces:primefaces-integration-tests (>=13.0.10.liferay-patched-1, <=15.0.6.liferay-patched-1) +58 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3.1, =19.12.0, =13.0.10.liferay-patched-1, =4.0.15.0, =4.0.9.0, =8.0.0.final, =1.7.2.230613, =1.7.2.230622, =3.1.0, =2.3.1, =2.3.1, =2.3.1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.15.2 and more Source cves:...

CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

cloud.piranha.extension:piranha-extension-myfaces (>=22.9.0, <=22.10.0), cloud.piranha:debug (>=22.9.0, <=22.10.0) +56 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.0.0-rc1, <=4.0.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.0.0-rc1, =22.9.0, =22.9.0, =13.0.10.liferay-patched-1, =4.1.0, =4.1.0, =4.1.0, =4.5.1 and more Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-68536 Sou...