CVE-2026-76646
Description
A flaw was found in Apache MyFaces. A remote attacker could exploit this by sending specially crafted request parameters, leading to excessive resource consumption. This could potentially result in a denial of service (DoS) condition, making the affected system unavailable to legitimate users.
Statement
This vulnerability is rated as Important because unauthenticated remote attackers can exhaust server resources over the network without requiring privileges or user interaction, leading to complete service unavailability. Apache MyFaces is typically deployed within Java application servers to handle user interface requests for web applications. When exposed to untrusted traffic, vulnerable endpoints can be targeted to cause high CPU or memory consumption, disrupting critical application workloads.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
