Description
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition.
Older unsupported versions may also be affected.
Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache MyFaces | 2.2.0-beta – ≤ 2.2.15, 2.3.0, 2.3-next-M1 – ≤ 2.3-next-M8, 2.3.1 – ≤ 2.3.11, 3.0.0 – ≤ 3.0.3, 4.0.0 – ≤ 4.0.3, 4.1.0 – ≤ 4.1.3 | — |
Advisories 1
- WID-SEC-2026-3909 IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
References
- https://lists.apache.org/thread/q8zxrdhbmmx8ofgr9s7ymnqo8l2x8oy9 vendor-advisory