WSO2-2026-4608¶

Content to be added.¶

title: Security Advisory WSO2-2026-4608/CVE-2026-3863 category: security-announcements published: "July 04, 2026" version: "1.0" severity: "Medium" cvss: "4.9"

Security Advisory WSO2-2026-4608/CVE-2026-3863¶

Published: July 04, 2026

Updated: July 04, 2026

Version: 1.0

Severity: Medium

CVSS Score: 4.9

CVE IDs: CVE-2026-3863

AFFECTED PRODUCTS¶

• WSO2 API Control Plane: 4.6.0, 4.5.0
• WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 3.2.1, 3.2.0
• WSO2 Traffic Manager: 4.6.0, 4.5.0
• WSO2 Universal Gateway: 4.6.0, 4.5.0

OVERVIEW¶

Authenticated Denial-of-Service (DoS) vulnerability.

DESCRIPTION¶

An authenticated user with publisher privileges can submit a URL referencing a large file. Processing this file can lead to uncontrolled memory consumption, potentially resulting in an out-of-memory condition.

IMPACT¶

A user with publisher privileges can exploit this vulnerability. A successful exploitation could result in the complete unavailability of the service.

SOLUTION¶

Community Users (Open Source)¶

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2/product-apim/pull/14151
• https://github.com/wso2/carbon-apimgt/pull/13784

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level or a higher update level to apply the fix.

After applying the provided update or public PR to the affected product versions, it is necessary to follow the below given instruction.

This update resolves the issue by enforcing a default file upload limit of 10 MB. To adjust this limit, you can modify the <PRODUCT HOME>/repository/conf/deployment.toml file. Apply the following configurations to increase or decrease the default file size limit as part of the security update:

• For WSO2 APIM 3.2.0, 3.2.1:

[apim.publisher.import_definition_file_size_limit]
oas=20
wsdl=20

For WSO2 APIM 4.1.0, 4.2.0, 4.3.0, 4.4.0:

[apim.publisher.import_definition_file_size_limit]
oas=20
wsdl=20
async=20

• For WSO2 APIM 4.5.0:

[apim.publisher.import_definition_file_size_limit]
oas=20
wsdl=20
async=20
graphql=20

• For WSO2 APIM 4.6.0:

[apim.publisher.import_definition_file_size_limit]
oas=20
wsdl=20
async=20
graphql=20
mcp=20

The aforementioned values represent the maximum file size limit in megabytes (MB) for importing API definitions through a URL across OAS, Async, WSDL, GraphQL, and MCP formats.