Summary
CVE-2026-4249 is a high-severity unauthenticated Denial of Service vulnerability affecting the throttling event handling mechanism in WSO2 API Manager and several related WSO2 products. An unauthenticated remote attacker can send crafted JSON payloads to the throttling endpoint, triggering a persistent DoS condition that stops all API traffic from being processed and requires manual intervention to restore service. The vulnerability carries a CVSS v3.1 score of 8.6 (High) with a Changed scope (S:C), indicating that the impact extends beyond the directly vulnerable component to the broader API Gateway infrastructure.
Technical details
- Root cause: The throttling event handling mechanism accepts user-supplied JSON payloads without sufficient validation of their structure or content (CWE-707: Use of Out-of-Scope Validation), allowing malicious data to be injected into the throttling pipeline.
- Trigger conditions: An unauthenticated attacker sends specially crafted JSON data to the throttling endpoint; no prior access, credentials, or user interaction are required to trigger the condition.
- Attack vector: Network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N).
- Impact: Persistent Denial of Service — the API Gateway is rendered unable to process legitimate API traffic. The condition persists until manual intervention restores normal operations. Changed scope (S:C) means downstream consumers and dependent services are also affected, not just the vulnerable component itself.
Affected software
- WSO2 API Manager: 3.2.0 (all builds through 3.2.0.469), 3.2.1 prior to 3.2.1.89, 4.0.0 (all builds through 4.0.0.389), 4.1.0 (all builds through 4.1.0.253), 4.2.0 (all builds through 4.2.0.193), 4.3.0 (all builds through 4.3.0.104), 4.4.0 (all builds through 4.4.0.68), 4.5.0 prior to Update 54 (4.5.0.54), 4.6.0 prior to Update 18 (4.6.0.18), 4.7.0 prior to Update 2 (4.7.0.2)
- WSO2 Universal Gateway: 4.5.0 prior to Update 54 (4.5.0.54), 4.6.0 prior to Update 18 (4.6.0.18), 4.7.0 prior to Update 2 (4.7.0.2)
- WSO2 Traffic Manager: 4.5.0 prior to Update 53 (4.5.0.53), 4.6.0 prior to Update 18 (4.6.0.18), 4.7.0 prior to Update 2 (4.7.0.2)
- WSO2 API Control Plane: 4.5.0 prior to Update 55 (4.5.0.55), 4.6.0 prior to Update 19 (4.6.0.19), 4.7.0 prior to Update 2 (4.7.0.2)
Severity
- CVSS v3.1 Base Score: 8.6 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Mitigation and recommended actions
- Apply vendor patches immediately — upgrade to the following fixed versions:
- WSO2 API Manager: 3.2.1 Update 89, 4.5.0 Update 54, 4.6.0 Update 18, or 4.7.0 Update 2
- WSO2 Universal Gateway: 4.5.0 Update 54, 4.6.0 Update 18, or 4.7.0 Update 2
- WSO2 Traffic Manager: 4.5.0 Update 53, 4.6.0 Update 18, or 4.7.0 Update 2
- WSO2 API Control Plane: 4.5.0 Update 55, 4.6.0 Update 19, or 4.7.0 Update 2
- End-of-life branches (API Manager 3.2.0 and 4.0.0 through 4.4.0): No patch is available within these branches. Organizations running these versions should migrate to a currently supported and patched release.
- Open-source users can apply the fix directly by incorporating GitHub pull requests #14217, #14035, and #14054 into their builds.
- Important: The patch introduces an authentication check on the throttling endpoint. Review any existing integration flows that rely on unauthenticated access to this endpoint before applying the update to avoid disruption.
- Network-level mitigation: Where immediate patching is not feasible, restrict network access to the throttling endpoint at the perimeter to trusted internal systems only.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.