52 matches found
Security Bulletin: IBM WebSphere Application Server is affected by an Allocation of Resources Without Limits or Throttling vulnerability due to Apache CXF ( CVE-2026-107937)
Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-107937 DESCRIPTION: In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size...
CVE-2022-46364-htb-ctf
DevArea SOAP Exploitation Tool CVE-2022-46364 Description This specialized exploit targets the DevArea environment on Hack The Box. It leverages a critical vulnerability in Apache CXF 3.2.14 CVE-2022-46364 to perform Local File Inclusion LFI and Server-Side Request Forgery SSRF. The script abuses...
CVE-2022-46364
CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof-of-Concept exploit for CVE-2022-46364 — an Apache CXF server-side request forgery SSRF vulnerability in MTOM/XOP request processing. Vulnerability Summary CVE-2022-46364 affects Apache CXF versions before 3.4.10 and 3.5.5. When MTOM Messag...
CVE-2022-46364-Proof-of-the-concept
CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...
CVE-2022-46364-Poc
CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...
CLEANSTART-2026-RF61847 In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (defau...
Security vulnerability affects the wildfly package. In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits...
CVE-2022-46364-poc
CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Author: 0xmid00 Vulnerability: SSRF / Local File Read via XOP:Include in MTOM requests Affected: Apache CXF 3.5.5 and 3.4.10 What is the Vulnerability? Apache CXF processes MTOM Message Transmission Optimization Mechanism messages that contain...
CVE-2026-107937
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
CVE-2026-107937 Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
EUVD-2026-95702
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
CVE-2026-107937 Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
CVE-2026-107937
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
CVE-2026-107937
In Apache CXF , the parser for multipart/MTOM attachment part headers fails to fully enforce attachment-max-header-size and attachment-headers-max-count limits. Specifically, size limits are only applied to physical lines rather than continuation lines or repeated headers, and count limits check ...
CVE-2026-107937 Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
PT-2026-108811
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The parser for multipart/MTOM attachment part headers fails to strictly enforce the attachment-max-header-size and...
CVE-2026-107937: Allocation of Resources Without Limits or Throttling
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
Exploit for Server-Side Request Forgery in Apache Cxf
CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof...
Exploit for Server-Side Request Forgery in Apache Cxf
DevArea SOAP Exploitation Tool CVE-2022-46364 Descripti...