October 28, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-76646NVD

Vulnerability Summary

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition.


Older unsupported versions may also be affected.

Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Severity Level
UNKNOWN
Published Date
Sep 16, 2026
Last Modified
Sep 17, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.58%Probability
Root Weakness (CWE)
CWE-400: Unknown/Unlisted Weakness ↗
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

Affected & Patched Versions

Affected Versions
  • Apache Software Foundation Apache MyFaces >= 2.2.0-beta and <= 2.2.15
  • Apache Software Foundation Apache MyFaces >= 2.3.0
  • Apache Software Foundation Apache MyFaces >= 2.3-next-M1 and <= 2.3-next-M8
  • Apache Software Foundation Apache MyFaces >= 2.3.1 and <= 2.3.11
  • Apache Software Foundation Apache MyFaces >= 3.0.0 and <= 3.0.3
  • Apache Software Foundation Apache MyFaces >= 4.0.0 and <= 4.0.3
  • Apache Software Foundation Apache MyFaces >= 4.1.0 and <= 4.1.3
Patched Versions
  • Apache Software Foundation Apache MyFaces 2.2.15
  • Apache Software Foundation Apache MyFaces 2.3-next-M8
  • Apache Software Foundation Apache MyFaces 2.3.11
  • Apache Software Foundation Apache MyFaces 3.0.3
  • Apache Software Foundation Apache MyFaces 4.0.3
  • Apache Software Foundation Apache MyFaces 4.1.3
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.

External References