CVE-2026-54225

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

Score
CVSS 3.1 7.5 High
Status
Modified - security@apache.org
Published
2026-08-06
Last modified
2026-10-24
Weaknesses
CWE-770

Affected products

References

 
 
© AVABIS GmbH privacypolicy about