CVE-2026-4249: WSO2 API Gateway Unauthenticated JSON Injection DoS

Technical summary

The throttling event handling subsystem in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway fails to validate incoming JSON payloads before processing them. This improper input validation (CWE-707) permits unauthenticated network-based injection of malformed JSON that triggers a persistent denial of service condition. The vulnerability requires no authentication, no user interaction, and low attack complexity—an attacker can exploit it with a single specially crafted network request. The scope is changed because a single compromised service affects the availability of dependent services and legitimate users.

Business impact

An organization running affected WSO2 products faces the risk of complete API Gateway outage. Since API Gateways typically serve as the central traffic control point for microservices and third-party integrations, exploitation can render all downstream APIs unreachable. This disrupts digital services, breaks internal service-to-service communication, and damages customer experience. The persistent nature of the DoS means the organization cannot simply wait for automatic recovery—manual intervention is required, extending downtime and recovery costs.

Affected systems

WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway are affected. Any deployment of these products that exposes the throttling event handler to untrusted network traffic is at risk. Organizations running these products in production environments should prioritize identifying and cataloging all instances.

Exploitability

This vulnerability has a low barrier to exploitation. No authentication is required, the attack can be mounted from any network-adjacent position, and attack complexity is minimal—a single HTTP request with a malicious JSON payload may be sufficient. The CVSS score of 8.6 (HIGH) reflects the ease of exploitation combined with the severity of impact. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, but the straightforward nature of the attack vector and lack of authentication requirements suggest it could be exploited opportunistically by network-based threat actors scanning for vulnerable instances.

Remediation

Immediately identify all instances of affected WSO2 products in your environment and check vendor advisories for patched versions. Apply security updates from WSO2 as soon as they become available. Verify patch application across all deployed instances. Additionally, implement network segmentation to restrict access to the throttling event handler to trusted internal networks only, and consider implementing rate-limiting or Web Application Firewall rules that validate JSON structure before it reaches the vulnerable handler.

Patch guidance

Check the WSO2 security advisories portal for the latest patches for API Control Plane, API Manager, Traffic Manager, and Universal Gateway. Verify the patch version numbers against the official advisory before deployment. Apply patches in a controlled manner, testing in non-production environments first. Coordinate patches across all interconnected WSO2 services to avoid inconsistent versions. Document the patch date and version for compliance and audit purposes.

Detection guidance

Monitor API Gateway logs for unusual JSON parsing errors or throttling handler crashes, particularly those correlating with requests from external sources. Look for patterns of malformed JSON submissions to throttling endpoints. Network intrusion detection systems can be tuned to identify suspicious payloads sent to known WSO2 API endpoints. Additionally, monitor system resources and API Gateway availability metrics for unexplained outages or resource exhaustion events that may indicate exploitation attempts.

Why prioritize this

Despite not yet being tracked as exploited in the wild, this vulnerability merits urgent prioritization due to its combination of unauthenticated remote exploitability, high CVSS score, and critical business impact. The attack requires no credentials or user interaction, making it suitable for opportunistic scanning and exploitation by threat actors. API Gateway outages cascade through dependent systems, making this a critical availability risk. The persistent nature of the DoS—requiring manual recovery—compounds the incident response burden.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects: unrestricted network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), changed scope due to impact on availability across services (S:C), and high availability impact (A:H). The absence of authentication combined with the ability to completely disable a critical infrastructure component drives the HIGH severity classification.

Frequently asked questions