CVE-2026-86463

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1	Issue Tracking Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/09/8	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::

History

20 Oct 2026, 12:41

Type	Values Removed	Values Added
References	~~() https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1 -~~	() https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1 - Issue Tracking, Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2026/10/09/8 -~~	() http://www.openwall.com/lists/oss-security/2026/10/09/8 - Mailing List, Third Party Advisory
First Time		Apache cxf Apache
CPE		cpe:2.3:a:apache:cxf::::::::

15 Oct 2026, 17:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CWE		CWE-400

09 Oct 2026, 12:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/09/8 -

09 Oct 2026, 11:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-09 11:17

Updated : 2026-10-20 12:41

NVD link : CVE-2026-86463

Mitre link : CVE-2026-86463

CVE.ORG link : CVE-2026-86463

JSON object : View

Products Affected

apache

cxf

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-86463", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86463", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T16:26:44.797809Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.4", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.9", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.13", "versionType": "semver"}], "packageURL": "pkg:maven/org.apache.cxf/cxf-rt-rs-extension-search", "packageName": "org.apache.cxf:cxf-rt-rs-extension-search", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-10-09T11:17:03.163", "references": [{"url": "https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/09/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.\n\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue."}], "lastModified": "2026-10-20T12:41:49.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CD2E496-3098-41C3-94A5-26A788711F15", "versionEndExcluding": "3.6.13"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "989264A3-989E-4ED7-BA9A-74F6589B0282", "versionEndExcluding": "4.1.9", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA32F98B-64AC-4E85-BD29-6287A9883A00", "versionEndExcluding": "4.2.4", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}