EUVD-2026-53852
GHSA-rqrh-ghmh-74j5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable endpoint, no inherent authentication requirement; impact is availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
AnalysisAI
Uncontrolled resource consumption in Apache CXF's JAX-RS form parameter processing enables remote denial-of-service attacks against any exposed endpoint accepting form-encoded requests. The framework provides a 'maxFormParameterCount' configuration knob but sets no default ceiling, meaning unpatched deployments will parse arbitrarily large parameter sets until memory or CPU is exhausted. Fixed versions (4.2.3, 4.1.8, and 3.6.12) enforce a default cap of 500 parameters; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Apache CXF is a widely used open-source Java web services framework that implements JAX-RS (JSR-370) for RESTful endpoints. When a client submits an application/x-www-form-urlencoded or multipart/form-data request, CXF iterates over and materializes each named parameter into memory. CWE-400 (Uncontrolled Resource Consumption) captures the root cause: the absence of a hard upper bound on this iteration allows an adversary to drive unbounded heap allocation and CPU utilization within the server JVM. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*, covering all versions across the 3.x and 4.x branches prior to the patched releases. The 'maxFormParameterCount' option existed before this fix but was optional; the remediation makes a safe default (500) effective out-of-the-box.
RemediationAI
The primary fix is to upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12, as confirmed by the Apache advisory at https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov. These releases enforce a default 'maxFormParameterCount' of 500, closing the gap without requiring any operator configuration change. If an immediate upgrade is not feasible, a workaround is to explicitly set 'maxFormParameterCount' in the CXF endpoint or bus configuration to a value appropriate for the application (e.g., 100-500); this requires a configuration deploy rather than a code change and has no functional side effect unless the application legitimately expects more parameters than the chosen limit. Additionally, placing a reverse proxy or WAF in front of CXF endpoints that enforces a maximum POST body parameter count can reduce exposure, though this is an imperfect compensating control compared to patching.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today