There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - There is no restriction on the amount of attachment headers that a message can contain when being
    deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service
    attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by
    imposing a maximum default of 500 attachments per message. (CVE-2026-50645)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7278576 advisory.

  - There is no restriction on the amount of attachment headers that a message can contain when being     deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service     attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a     maximum default of 500 attachments per message. (CVE-2026-50645)

  - IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of     service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability     to cause the server to consume memory resources. (CVE-2026-9171)

  - IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3     through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request. (CVE-2026-9322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache CXF installed on the remote host is prior to 4.1.7 or 4.2.x prior to 4.2.2. It is, therefore, affected by multiple vulnerabilities, including:

  - A JNDI Injection vulnerability in the JCA integration module allows code execution if an     attacker can manipulate the JCA deployment descriptor or runtime activation parameters.
    (CVE-2026-50633)

  - An incomplete fix for CVE-2026-44417 allows code execution if untrusted users are allowed to     configure JMS for Apache CXF. (CVE-2026-50632)

  - No restriction on the amount of attachment headers in a message during deserialization can lead     to uncontrolled resource consumption or denial of service. (CVE-2026-50645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
445789	SCA: security update for org.apache.cxf:cxf-core (GHSA-ghvc-7hp8-2g2v)	Tenable Cloud Security	SCA Checks	Local	high
445789	SCA: security update for org.apache.cxf:cxf-core (GHSA-ghvc-7hp8-2g2v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324011	IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 / Liberty 17.0.0.3 < 26.0.0.8 (7278576)	Nessus	Web Servers	Combined	high
321189	Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-50645

high

Tenable Plugins

high

high

high

high