CVE-2026-4249
Last modified
CVE-2026-4249 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wso2 | Api Control Plane | >= 4.5.0, < 4.5.0.55 |
| Wso2 | Api Control Plane | >= 4.6.0, < 4.6.0.19 |
| Wso2 | Api Manager | >= 4.0.0, < 4.0.0.390 |
| Wso2 | Api Manager | >= 4.1.0, < 4.1.0.254 |
| Wso2 | Api Manager | >= 4.2.0, < 4.2.0.194 |
| Wso2 | Api Manager | >= 4.3.0, < 4.3.0.105 |
| Wso2 | Api Manager | >= 4.4.0, < 4.4.0.69 |
| Wso2 | Api Manager | >= 4.5.0, < 4.5.0.54 |
| Wso2 | Api Manager | >= 4.6.0, < 4.6.0.18 |
| Wso2 | Traffic Manager | >= 4.5.0, < 4.5.0.53 |
| Wso2 | Traffic Manager | >= 4.6.0, < 4.6.0.18 |
| Wso2 | Universal Gateway | >= 4.5.0, < 4.5.0.54 |
| Wso2 | Universal Gateway | >= 4.6.0, < 4.6.0.18 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-4249?
How severe is CVE-2026-4249?
How do I fix CVE-2026-4249?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42484A heap-based buffer overflow in hex_to_binary in the PKZIP h…9.8
- CVE-2026-42485AGL agl-service-can-low-level contains a stack buffer overfl…7.5
- CVE-2026-42486[This CNA information record relates to multiple CVEs; the t…9.4
- CVE-2026-42487HVM guest I/O port accesses are subject to either emulation …7.9
- CVE-2026-42488Some shadow paging errors paths will switch the page-tables …8.1
- CVE-2026-42489[This CNA information record relates to multiple CVEs; the t…5.3
- CVE-2026-42490[This CNA information record relates to multiple CVEs; the t…6.5
- CVE-2026-42492Xenstore, to have an up-to-date picture of the entire system…7.5
- CVE-2026-42493Addressing certain issues, in particular related to operatio…7.5
- CVE-2026-42494[This CNA information record relates to multiple CVEs; the t…6.1
- CVE-2026-42495[This CNA information record relates to multiple CVEs; the t…5.5
- CVE-2026-42496Archive::Tar versions before 3.08 for Perl extract symlinks …9.1
Are you affected by CVE-2026-4249?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST