{"schema_version": "1.6.1", "id": "CVE-2026-76646", "summary": "Denial of Service via Unbounded Request Parsing", "details": "A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition.\n\n\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "2.2.0-beta"}, {"last_affected": "2.2.0-beta"}]}, {"type": "SEMVER", "events": [{"introduced": "2.3.0"}, {"last_affected": "2.3.0"}]}, {"type": "SEMVER", "events": [{"introduced": "2.3-next-M1"}, {"last_affected": "2.3-next-M1"}]}, {"type": "SEMVER", "events": [{"introduced": "2.3.1"}, {"last_affected": "2.3.1"}]}, {"type": "SEMVER", "events": [{"introduced": "3.0.0"}, {"last_affected": "3.0.0"}]}, {"type": "SEMVER", "events": [{"introduced": "4.0.0"}, {"last_affected": "4.0.0"}]}, {"type": "SEMVER", "events": [{"introduced": "4.1.0"}, {"last_affected": "4.1.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/q8zxrdhbmmx8ofgr9s7ymnqo8l2x8oy9"}]}