[<prev] [next>] [day] [month] [year] [list]
Message-ID: <cd9957d2-0630-f4cc-671d-19791ce8df5f@apache.org>
Date: Thu, 06 Aug 2026 10:04:42 +0000
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-57819: Apache CXF: No default restriction on the amount
of form parameters per message
Severity: low
Affected versions:
- Apache CXF (org.apache.cxf:cxf-rt-frontend-jaxrs) 4.2.0 before 4.2.3
- Apache CXF (org.apache.cxf:cxf-rt-frontend-jaxrs) 4.0.0 before 4.1.8
- Apache CXF (org.apache.cxf:cxf-rt-frontend-jaxrs) before 3.6.12
Description:
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-57819
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
