CVE-2026-4249— Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-4249
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
Source: NVD (National Vulnerability Database)
Vulnerability Description
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对消息或数据结构的处理不恰当
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WSO2 | WSO2 Universal Gateway | 4.5.0 ~ 4.5.0.54 | - | |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ~ 4.5.0.53 | - | |
| WSO2 | WSO2 API Control Plane | 4.5.0 ~ 4.5.0.55 | - | |
| WSO2 | WSO2 API Manager | 3.2.0 ~ 3.2.0.470 | - |
II. Public POCs for CVE-2026-4249
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4249
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-4249 (1)
- 🔗 Security Advisory WSO2-2026-5236/CVE-2026-4249vendor-advisory
IV. Related Vulnerabilities
Same vendor: WSO2
- CVE-2025-8591
Reflected Cross-Site Scripting via URL Parameter in Multiple - CVE-2024-1248
Role Overwriting via Silent JIT Provisioning in Multiple WSO - CVE-2025-13475
Cross-Tenant Access via Application Consent Mismanagement in - CVE-2026-2053
Unauthenticated Server-Side Request Forgery via WS-Addressin - CVE-2025-10470
Denial-of-Service via Magic Link Authentication in WSO2 Iden
Same weakness: CWE-707
- CVE-2025-66545
Nextcloud Groupfolders users with read-only permissions for - CVE-2025-26633
Microsoft Management Console Security Feature Bypass Vulnera - CVE-2024-43572
Microsoft Management Console Remote Code Execution Vulnerabi - CVE-2022-4729
Graphite Web Template Name cross site scripting - CVE-2022-4728
Graphite Web Cookie cross site scripting
V. Comments for CVE-2026-4249
No comments yet