CVE-2026-54225

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/14

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Apache CXF permite controlar el tamaño máximo de los adjuntos a través de ’attachment-max-size’. Antes de Apache CXF 4.2.3, 4.1.8 y 3.6.12, no había un valor predeterminado establecido para este tamaño, lo que significa que un ataque de denegación de servicio es posible si el usuario no establece explícitamente el límite. Los usuarios deben actualizar a Apache CXF 4.2.3 o 4.1.8 o 3.6.12, que soluciona este problema al imponer un límite de tamaño de adjunto predeterminado de 50 MB.

Information

Published : 2026-08-06 11:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-54225

Mitre link : CVE-2026-54225

CVE.ORG link : CVE-2026-54225

JSON object : View

Products Affected

apache

cxf

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-54225", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54225", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T15:11:47.429899Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.3", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.8", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T11:16:30.003", "references": [{"url": "https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/06/14", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Apache CXF allows to control the maximum attachment size via the\u00a0\"attachment-max-size\". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb."}, {"lang": "es", "value": "Apache CXF permite controlar el tama\u00f1o m\u00e1ximo de los adjuntos a trav\u00e9s de \u2019attachment-max-size\u2019. Antes de Apache CXF 4.2.3, 4.1.8 y 3.6.12, no hab\u00eda un valor predeterminado establecido para este tama\u00f1o, lo que significa que un ataque de denegaci\u00f3n de servicio es posible si el usuario no establece expl\u00edcitamente el l\u00edmite. Los usuarios deben actualizar a Apache CXF 4.2.3 o 4.1.8 o 3.6.12, que soluciona este problema al imponer un l\u00edmite de tama\u00f1o de adjunto predeterminado de 50 MB."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09753EF1-BB56-4238-8ED7-609E2AB5EB05", "versionEndExcluding": "3.6.12"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "801F031C-B5F5-4CF5-B9A5-DD9AA2F76A66", "versionEndExcluding": "4.1.8", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A112761E-E622-4AE5-9BE6-47A247021D4F", "versionEndExcluding": "4.2.3", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}