Resource exhaustion in Apache Cxf
CVE-2026-57819
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.005 (39.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Cxf
- Apache Software Foundation Cxf — versions 4.2.0, 4.0.0, 0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-57819?
- CVE-2026-57819 is a high-severity vulnerability in Apache Cxf, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-08-06.
- How severe is CVE-2026-57819?
- High severity. CVSS v3 base score is 7.5 out of 10.