CVE-2026-4249 - Vulnerability Details

- Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

Description

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

Published: 2026-07-06

Score: 8.6 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An unauthenticated remote attacker can send crafted JSON payloads to the throttling event endpoint of WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. The lack of proper validation in the event handling logic allows malicious data to corrupt the service, causing a persistent denial of service that blocks all legitimate API traffic. This flaw, classified as CWE‑707, results in a complete outage of the gateway and requires manual intervention to restore normal operations.

Affected Systems

WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway are affected. No specific version information is supplied; all current releases may be impacted and vendors should be consulted for precise scope.

Risk and Exploitability

The CVSS rating of 8.6 classifies the issue as high severity. An EPSS score below 1% indicates a low overall probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated remote request to the throttling event endpoint, which can lead to a persistent outage that requires manual recovery.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 Universal Gateway

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.54
`4.6.0`	affected	< 4.6.0.18
`4.7.0`	affected	< 4.7.0.2

WSO2

WSO2 Traffic Manager

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.53
`4.6.0`	affected	< 4.6.0.18
`4.7.0`	affected	< 4.7.0.2

WSO2

WSO2 API Control Plane

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.55
`4.6.0`	affected	< 4.6.0.19
`4.7.0`	affected	< 4.7.0.2

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 3.2.0
`3.2.0`	affected	< 3.2.0.470
`3.2.1`	affected	< 3.2.1.89
`4.0.0`	affected	< 4.0.0.390
`4.1.0`	affected	< 4.1.0.254
`4.2.0`	affected	< 4.2.0.194
`4.3.0`	affected	< 4.3.0.105
`4.4.0`	affected	< 4.4.0.69
`4.5.0`	affected	< 4.5.0.54
`4.6.0`	affected	< 4.6.0.18
`4.7.0`	affected	< 4.7.0.2

No data.

Vendor Product Confidence Versions

Wso2

Wso2 Api Control Plane

100%

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.55)`	affected	generic	—
`[4.6.0,4.6.0.19)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Wso2

Wso2 Api Manager

100%

Version	Status	Scheme	Platform
`[3.2.0,3.2.0.470)`	affected	generic	—
`[3.2.1,3.2.1.89)`	affected	generic	—
`[4.0.0,4.0.0.390)`	affected	generic	—
`[4.1.0,4.1.0.254)`	affected	generic	—
`[4.2.0,4.2.0.194)`	affected	generic	—
`[4.3.0,4.3.0.105)`	affected	generic	—
`[4.4.0,4.4.0.69)`	affected	generic	—
`[4.5.0,4.5.0.54)`	affected	generic	—
`[4.6.0,4.6.0.18)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Wso2

Wso2 Traffic Manager

100%

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.53)`	affected	generic	—
`[4.6.0,4.6.0.18)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Wso2

Wso2 Universal Gateway

100%

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.54)`	affected	generic	—
`[4.6.0,4.6.0.18)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/#solution

OpenCVE Recommended Actions

Apply the vendor‑supplied patch or upgrade to a fixed release by following the instructions in the WSO2 2026‑5236 solution document (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/#solution).
If a patch cannot be applied immediately, enforce strict input validation on the throttling event JSON payloads, rejecting any messages that do not match the expected schema to mitigate CWE‑707.
Restrict or block unauthenticated access to the throttling event endpoint via firewall rules or API gateway policies, or enable authentication to reduce the attack surface while a patch is applied.

Generated by OpenCVE AI on July 26, 2026 at 20:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00339.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/

History

Mon, 06 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 06 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
Title		Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
First Time appeared		Wso2 Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway
Weaknesses		CWE-707
CPEs		cpe:2.3:a:wso2:wso2_api_control_plane:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_traffic_manager:::::::: cpe:2.3:a:wso2:wso2_universal_gateway::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'}`

Subscriptions

Wso2 Wso2 Api Control Plane Wso2 Api Manager Wso2 Traffic Manager Wso2 Universal Gateway

MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2026-07-06T10:16:56.055Z

Updated: 2026-07-06T11:03:48.847Z

Reserved: 2026-03-16T05:47:35.673Z

Link: CVE-2026-4249

Vulnrichment

Updated: 2026-07-06T11:03:28.003Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-26T20:45:03Z

Weaknesses

CWE-707
Improper Neutralization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object