CVE-2026-4249

{"id": "CVE-2026-4249", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4249", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T11:03:16.637529Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.54", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.18", "versionType": "custom"}, {"status": "affected", "version": "4.7.0", "lessThan": "4.7.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.53", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.18", "versionType": "custom"}, {"status": "affected", "version": "4.7.0", "lessThan": "4.7.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.55", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.19", "versionType": "custom"}, {"status": "affected", "version": "4.7.0", "lessThan": "4.7.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.470", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.89", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.390", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.254", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.194", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.105", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.69", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.54", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.18", "versionType": "custom"}, {"status": "affected", "version": "4.7.0", "lessThan": "4.7.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-06T11:16:30.433", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-707"}]}], "descriptions": [{"lang": "en", "value": "The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.\n\nSuccessful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations."}], "lastModified": "2026-07-09T13:04:57.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6AE2096-6207-4861-A980-64F5416C19D6", "versionEndExcluding": "4.5.0.55", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC38E438-7325-4C66-A5A8-37B7D8F13B91", "versionEndExcluding": "4.6.0.19", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0703E142-37D2-4078-B277-923B3A457E2B", "versionEndExcluding": "4.0.0.390", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A867EE45-A0AC-4B09-83BA-A6272A2EA011", "versionEndExcluding": "4.1.0.254", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6803CD9D-A16A-4D44-84C6-E5D633C965AD", "versionEndExcluding": "4.2.0.194", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46411B3B-15A5-4B79-9C39-3D09F7454B65", "versionEndExcluding": "4.3.0.105", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "637EDDCF-CE42-418E-A556-B74290D9C6A7", "versionEndExcluding": "4.4.0.69", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94BB9179-F8AB-478E-8C20-50FB326DECA0", "versionEndExcluding": "4.5.0.54", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99985361-612C-40EE-9630-1261BD87997C", "versionEndExcluding": "4.6.0.18", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64AC5FDC-E47A-48CF-87AD-E2F5B692AE7F", "versionEndExcluding": "4.5.0.53", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "551D22E4-FAA7-452F-ADF8-E1AC91150C28", "versionEndExcluding": "4.6.0.18", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE92AC9A-4016-4715-86F5-0D00DECBD21D", "versionEndExcluding": "4.5.0.54", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC1DB254-830D-452A-AA6C-D3B87C9A4B3A", "versionEndExcluding": "4.6.0.18", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}