CVE-2026-54225CWE-770denial-of-service

CVE-2026-54225

High · published August 6, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00732 · 53.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-06T15:16Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.123.6.12
apache/cxf≥ 4.0.0, < 4.1.84.1.8
apache/cxf≥ 4.2.0, < 4.2.34.2.3
References (2)
https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy · [email protected]http://www.openwall.com/lists/oss-security/2026/08/06/14 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 AUG 10:11Z
    Apache CXF: Denial of Service attack via large attachments
    cvelistv5