Apache CXF has no limit on the number of attachment headers that can be present in a message during deserialization, which can lead to uncontrolled resource consumption or a denial of service attack. Each attachment consumes memory and CPU resources, potentially depleting system capacity and causing the service to become unresponsive or crash. The flaw is classified as a resource‑consumption weakness (CWE-400).

The vulnerability affects the Apache CXF framework distributed by the Apache Software Foundation. Versions older than 4.2.2 or 4.1.7 do not enforce an attachment threshold and are therefore vulnerable. Updating to Apache CXF 4.2.2 or 4.1.7 installs a default cap of 500 attachments per message, mitigating the issue.

The description indicates that an attacker could send an XML message with an excessive number of attachment headers to an exposed CXF endpoint. Based on this information, it is inferred that the flaw can be exploited remotely without authentication, and would trigger memory exhaustion or processing delays. The CVSS score of 7.5 reflects a high severity denial of service vulnerability. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a resource cap makes it a high‑risk denial of service vector in environments with unrestricted inbound traffic.