CVE-2026-76646NVD

Vulnerability Summary

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition.

Older unsupported versions may also be affected.

Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

Severity Level

UNKNOWN

Published Date

Sep 16, 2026

Last Modified

Sep 17, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.51%Probability

Root Weakness (CWE)

CWE-400: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

Affected & Patched Versions

Affected Versions

Apache Software Foundation Apache MyFaces >= 2.2.0-beta and <= 2.2.15
Apache Software Foundation Apache MyFaces >= 2.3.0
Apache Software Foundation Apache MyFaces >= 2.3-next-M1 and <= 2.3-next-M8
Apache Software Foundation Apache MyFaces >= 2.3.1 and <= 2.3.11
Apache Software Foundation Apache MyFaces >= 3.0.0 and <= 3.0.3
Apache Software Foundation Apache MyFaces >= 4.0.0 and <= 4.0.3
Apache Software Foundation Apache MyFaces >= 4.1.0 and <= 4.1.3

Patched Versions

Apache Software Foundation Apache MyFaces 2.2.15
Apache Software Foundation Apache MyFaces 2.3-next-M8
Apache Software Foundation Apache MyFaces 2.3.11
Apache Software Foundation Apache MyFaces 3.0.3
Apache Software Foundation Apache MyFaces 4.0.3
Apache Software Foundation Apache MyFaces 4.1.3

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.