Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-76646

Apache MyFaces: Denial of Service via Unbounded Request Parsing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache MyFaces

Default version status: unaffected

  • 2.2.0-beta to ≤ 2.2.15affected
  • 2.3.0affected
  • 2.3-next-M1 to ≤ 2.3-next-M8affected
  • 2.3.1 to ≤ 2.3.11affected
  • 3.0.0 to ≤ 3.0.3affected
  • 4.0.0 to ≤ 4.0.3affected
  • 4.1.0 to ≤ 4.1.3affected

References