# CVE-2026-4249: WSO2 Multiple Products persistent DoS in throttling event handling

Source: https://junglewise.ai/threats/cve-2026-4249-wso2-multiple-products-persistent-dos-in-throttling-event-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-4249 · Severity: high · CVSS 8.6 · Published 2026-07-06

A vulnerability in several WSO2 API management products could allow an unauthorized person to crash the API Gateway, which is responsible for directing and securing corporate web traffic. By sending specially crafted data, an attacker can cause a persistent service outage that prevents legitimate users and applications from accessing company services. Restoring normal operations requires manual intervention by IT staff, potentially leading to significant business downtime.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager), [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2026-4249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4249 being exploited in the wild.

**How severe is CVE-2026-4249?** High severity, with a CVSS score of 8.6, published 6 July 2026.

**Which products and versions are affected?** Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.2.0 to 4.6.0; Wso2 Traffic Manager 4.5.0, 4.6.0; Wso2 Universal Gateway 4.5.0, 4.6.0.

**Is there a fix for CVE-2026-4249?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4249 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4249?** Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in the throttling event handling mechanism of multiple WSO2 products due to improper neutralization of input (CWE-707). An unauthenticated remote attacker can submit malicious JSON payloads to the throttling endpoint that the system fails to validate for structure and content. This leads to a persistent DoS condition within the API Gateway, halting the processing of all legitimate API traffic. The vulnerability is mitigated in newer updates by introducing an authentication check for the throttling endpoint and improving payload validation. Patches are available for affected versions including API Manager 3.2.0 through 4.6.0.

## Affected products

- WSO2 API Manager 3.2.0 to 4.6.0
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 Traffic Manager 4.5.0, 4.6.0
- WSO2 Universal Gateway 4.5.0, 4.6.0

## Timeline

- 2026-05-03: advisory: Initial advisory published by WSO2
- 2026-07-06: disclosed: CVE published to NVD dataset

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)