CVE-2026-107937: Apache CXF 4.2.0 to before 4.2.4, 4.0.0 to before 4.1.9, 0 to before 3.6.13

Affected technology

Apache CXF · 4.2.0 to before 4.2.4, 4.0.0 to before 4.1.9, 0 to before 3.6.13
Apache Software Foundation

Component: Not specified by the source

What an attacker can do

Unauthenticated attacker could send a multipart request with very large folded or repeated part headers.