Executive brief
Apache MyFaces is a widely-used Java framework for building web applications with reusable UI components. A remote attacker can trigger excessive resource consumption by sending specially crafted request parameters, causing the application to become unresponsive or crash—effectively knocking the service offline without authentication.
Technical details
The vulnerability is a denial of service (DoS) weakness caused by unbounded request parsing in Apache MyFaces. A remote attacker can exploit this by crafting malicious request parameters that force the application to consume excessive CPU, memory, or processing time. The attack requires only network access to a vulnerable MyFaces application and no authentication; a single request can be enough to degrade or halt service availability. Patches are available in versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, and 4.1.4.
Affected products
- Apache MyFaces 2.2.0 through 2.2.15, 2.3.0 through 2.3.11, 2.3-next prior to M9, 3.0.0 through 3.0.3, 4.0.0 through 4.0.3, 4.1.0 through 4.1.3
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, and 4.1.4