CVE-2026-4249 - Vulnerability Details

- Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

Description

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

Published: 2026-07-06

Score: 8.6 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from the throttling event handler in multiple WSO2 products, which accepts user-supplied JSON payloads without sufficient validation. An unauthenticated remote attacker can craft malicious JSON and send it, triggering a related services. The disruption is permanent and requires manual intervention to restore normal operations.

Affected Systems

WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. All current versions of these products are affected.

Risk and Exploitability

With a CVSS score of 8.6 the vulnerability is classified as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated remote, relying on sending malicious JSON to the throttling event API; no authentication or privileged access is required.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 Universal Gateway

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.54
`4.6.0`	affected	< 4.6.0.18
`4.7.0`	affected	< 4.7.0.2

WSO2

WSO2 Traffic Manager

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.53
`4.6.0`	affected	< 4.6.0.18
`4.7.0`	affected	< 4.7.0.2

WSO2

WSO2 API Control Plane

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.55
`4.6.0`	affected	< 4.6.0.19
`4.7.0`	affected	< 4.7.0.2

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 3.2.0
`3.2.0`	affected	< 3.2.0.470
`3.2.1`	affected	< 3.2.1.89
`4.0.0`	affected	< 4.0.0.390
`4.1.0`	affected	< 4.1.0.254
`4.2.0`	affected	< 4.2.0.194
`4.3.0`	affected	< 4.3.0.105
`4.4.0`	affected	< 4.4.0.69
`4.5.0`	affected	< 4.5.0.54
`4.6.0`	affected	< 4.6.0.18
`4.7.0`	affected	< 4.7.0.2

No data.

Vendor Product Confidence Versions

Wso2

Wso2 Api Control Plane

100%

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.55)`	affected	generic	—
`[4.6.0,4.6.0.19)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Wso2

Wso2 Api Manager

100%

Version	Status	Scheme	Platform
`[3.2.0,3.2.0.470)`	affected	generic	—
`[3.2.1,3.2.1.89)`	affected	generic	—
`[4.0.0,4.0.0.390)`	affected	generic	—
`[4.1.0,4.1.0.254)`	affected	generic	—
`[4.2.0,4.2.0.194)`	affected	generic	—
`[4.3.0,4.3.0.105)`	affected	generic	—
`[4.4.0,4.4.0.69)`	affected	generic	—
`[4.5.0,4.5.0.54)`	affected	generic	—
`[4.6.0,4.6.0.18)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Wso2

Wso2 Traffic Manager

100%

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.53)`	affected	generic	—
`[4.6.0,4.6.0.18)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Wso2

Wso2 Universal Gateway

100%

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.54)`	affected	generic	—
`[4.6.0,4.6.0.18)`	affected	generic	—
`[4.7.0,4.7.0.2)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/#solution

OpenCVE Recommended Actions

Apply the patch or upgrade to the fixed versions following the instructions in the WSO2 2026-5236 solution document (https/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/#solution).
If patching is not immediately possible, temporarily restrict or disable the throttling event endpoint using firewall rules or configuration changes to prevent unauthenticated access.
Continuously monitor application logs for malformed JSON payloads and schedule automatic or manual service restarts if a persistent denial of service condition is detected.

Generated by OpenCVE AI on July 6, 2026 at 16:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/

History

Mon, 06 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 06 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
Title		Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
First Time appeared		Wso2 Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway
Weaknesses		CWE-707
CPEs		cpe:2.3:a:wso2:wso2_api_control_plane:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_traffic_manager:::::::: cpe:2.3:a:wso2:wso2_universal_gateway::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'}`

Subscriptions

Wso2 Wso2 Api Control Plane Wso2 Api Manager Wso2 Traffic Manager Wso2 Universal Gateway

MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2026-07-06T10:16:56.055Z

Updated: 2026-07-06T11:03:48.847Z

Reserved: 2026-03-16T05:47:35.673Z

Link: CVE-2026-4249

Vulnrichment

Updated: 2026-07-06T11:03:28.003Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-06T17:00:05Z

Weaknesses

CWE-707
Improper Neutralization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object