CVE-2026-57819

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/15

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Apache CXF permite establecer un límite en el número de parámetros de formulario en un mensaje JAX-RS a través de la opción de configuración ’maxFormParameterCount’. Sin embargo, no se establece ningún límite predeterminado, lo que puede llevar a ataques de denegación de servicio al procesar solicitudes con un número muy elevado de parámetros de formulario. Se recomienda a los usuarios actualizar a las versiones 4.2.3 o 4.1.8 o 3.6.12, que solucionan este problema utilizando un límite predeterminado de 500 parámetros.

Information

Published : 2026-08-06 11:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-57819

Mitre link : CVE-2026-57819

CVE.ORG link : CVE-2026-57819

JSON object : View

Products Affected

apache

cxf

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-57819", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57819", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T15:11:09.985498Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.3", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.8", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-rt-frontend-jaxrs", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T11:16:30.237", "references": [{"url": "https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/06/15", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing\u00a0 requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters."}, {"lang": "es", "value": "Apache CXF permite establecer un l\u00edmite en el n\u00famero de par\u00e1metros de formulario en un mensaje JAX-RS a trav\u00e9s de la opci\u00f3n de configuraci\u00f3n \u2019maxFormParameterCount\u2019. Sin embargo, no se establece ning\u00fan l\u00edmite predeterminado, lo que puede llevar a ataques de denegaci\u00f3n de servicio al procesar solicitudes con un n\u00famero muy elevado de par\u00e1metros de formulario. Se recomienda a los usuarios actualizar a las versiones 4.2.3 o 4.1.8 o 3.6.12, que solucionan este problema utilizando un l\u00edmite predeterminado de 500 par\u00e1metros."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09753EF1-BB56-4238-8ED7-609E2AB5EB05", "versionEndExcluding": "3.6.12"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "801F031C-B5F5-4CF5-B9A5-DD9AA2F76A66", "versionEndExcluding": "4.1.8", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A112761E-E622-4AE5-9BE6-47A247021D4F", "versionEndExcluding": "4.2.3", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}