Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76646

Apache MyFaces: Denial of Service via Unbounded Request Parsing

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76646

Published

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76646

Published

Apache MyFaces

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Apache Software Foundation",
                    "product": "Apache MyFaces",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2.2.0-beta",
                            "lessThanOrEqual": "2.2.15",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "2.3.0",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "2.3-next-M1",
                            "lessThanOrEqual": "2.3-next-M8",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "2.3.1",
                            "lessThanOrEqual": "2.3.11",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "3.0.0",
                            "lessThanOrEqual": "3.0.3",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "4.0.0",
                            "lessThanOrEqual": "4.0.3",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "4.1.0",
                            "lessThanOrEqual": "4.1.3",
                            "versionType": "maven"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON