CVE-2026-4249: WSO2 Multiple Products persistent DoS in throttling event handling

CVE-2026-4249 · Severity: high · CVSS 8.6 · Published 2026-07-06

A vulnerability in several WSO2 API management products could allow an unauthorized person to crash the API Gateway, which is responsible for directing and securing corporate web traffic. By sending specially crafted data, an attacker can cause a persistent service outage that prevents legitimate users and applications from accessing company services. Restoring normal operations requires manual intervention by IT staff, potentially leading to significant business downtime.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager, Wso2 Universal Gateway. Vendors: Wso2.

Quick answers

Is CVE-2026-4249 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4249 being exploited in the wild.
How severe is CVE-2026-4249?
High severity, with a CVSS score of 8.6, published 6 July 2026.
Which products and versions are affected?
Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.2.0 to 4.6.0; Wso2 Traffic Manager 4.5.0, 4.6.0; Wso2 Universal Gateway 4.5.0, 4.6.0.
Is there a fix for CVE-2026-4249?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4249 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4249?
Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in the throttling event handling mechanism of multiple WSO2 products due to improper neutralization of input (CWE-707). An unauthenticated remote attacker can submit malicious JSON payloads to the throttling endpoint that the system fails to validate for structure and content. This leads to a persistent DoS condition within the API Gateway, halting the processing of all legitimate API traffic. The vulnerability is mitigated in newer updates by introducing an authentication check for the throttling endpoint and improving payload validation. Patches are available for affected versions including API Manager 3.2.0 through 4.6.0.

Affected products

  • WSO2 API Manager 3.2.0 to 4.6.0
  • WSO2 API Control Plane 4.5.0, 4.6.0
  • WSO2 Traffic Manager 4.5.0, 4.6.0
  • WSO2 Universal Gateway 4.5.0, 4.6.0

Timeline

  • 2026-05-03: advisory: Initial advisory published by WSO2
  • 2026-07-06: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.