Apache CXF EUVD-2026-95698

Exploitation requires the target application to use Apache CXF's JAX-RS search extension with the FIQL query parser processing attacker-influenced query input (e.g., a search/filter endpoint accepting FIQL expressions). The trigger is a sufficiently long query string containing no recognizable operator, which drives the operator-search logic into excessive backtracking. LIMITING FACTORS: applications that do not expose FIQL/search query parsing are unaffected; and after the fix, FIQL expressions are capped at 4 KiB by default, so patched or input-size-limited deployments neutralize the long-input vector. No authentication requirement is confirmable from available data (no CVSS vector provided), so auth dependence cannot be asserted.

This is an availability-only denial-of-service issue in Apache CXF's FIQL query parser, where a crafted query string lacking an operator forces the parser into excessive combinatorial searching (algorithmic-complexity / ReDoS-style CPU exhaustion). NO CVSS vector, CWE, EPSS score, KEV listing, or POC was provided in the input, so quantitative exploitation-likelihood signals are entirely absent - risk must be reasoned from the description alone. The flaw is 'no public exploit identified at time of analysis' and is NOT in CISA KEV, so there is no evidence of active exploitation. On its face the issue is remotely triggerable with a single crafted request and low complexity, which argues for meaningful risk, but it is strongly gated by a deployment prerequisite: the target application must actually expose CXF's JAX-RS search/FIQL functionality to attacker-controlled input. The impact ceiling is service degradation/outage, not code execution or data exposure. Net: a real but moderate, availability-scoped priority for the subset of CXF deployments using FIQL search - not a widespread drop-everything event. Note a metadata conflict: the input tags this as 'Information Disclosure,' which contradicts the description (pure CPU-exhaustion DoS); treat the confidentiality framing as mislabeled.

An attacker identifies a CXF-based JAX-RS endpoint that accepts FIQL search expressions and submits a single crafted query containing a very long string with no valid operator. The parser burns excessive CPU attempting operator-match combinations, and repeating such requests exhausts server CPU, slowing or halting legitimate request processing. No public exploit code is identified at time of analysis.