VulnerabilityModified

CVE-2026-57819

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option.

HIGH 7.5EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-400
Affected: apache/cxf
Source: security@apache.org

References

https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289movMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/15

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.