Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
CPU exhaustion denial of service in Apache CXF's FIQL query parser allows remote attackers to degrade or stall a server by submitting a long search expression containing no recognizable operator, which drives the parser's operator-search logic into excessive combinatorial matching and burns CPU on a request-handling thread. Affected are CXF 3.6.x, 4.1.x and 4.2.x deployments that expose FIQL-based search/filter endpoints; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), meaning availability impact only, with confidentiality and integrity unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-released fixes - 4.2.4, 4.1.9 and 3.6.13 - neutralize the long-input vector by capping FIQL expressions at 4 KiB by default while still permitting normal queries.