Apache CXF has no limit on the number of attachment headers that can be present in a message during deserialization, allowing an attacker to flood the system with many attachments. Each attachment consumes memory and CPU resources, which can deplete available system capacity and cause the service to become unresponsive or to crash. The flaw is classified as a resource‑consumption weakness (CWE-400).

The vulnerability affects the Apache CXF framework distributed by the Apache Software Foundation. Versions older than 4.2.2 or 4.1.7 do not enforce an attachment threshold and are therefore vulnerable. Updating to Apache CXF 4.2.2 or 4.1.7 installs a default cap of 500 attachments per message, mitigating the issue.

The description indicates that an attacker could send an XML message with an excessive number of attachment headers to an exposed CXF endpoint. Based on this information, it is inferred that the flaw can be exploited remotely without authentication, and would trigger memory exhaustion or processing delays. The CVSS score of 7.5 reflects a high severity denial of service vulnerability. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a resource cap makes it a high‑risk denial of service vector in environments with unrestricted inbound traffic.