CVE-2026-57819CWE-400denial-of-service

CVE-2026-57819

High · published August 6, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00732 · 53.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-06T15:16Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.123.6.12
apache/cxf≥ 4.0.0, < 4.1.84.1.8
apache/cxf≥ 4.2.0, < 4.2.34.2.3
References (2)
https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov · [email protected]http://www.openwall.com/lists/oss-security/2026/08/06/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 AUG 10:12Z
    Apache CXF: No default restriction on the amount of form parameters per message
    cvelistv5