Description
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – < 4.2.3, 4.0.0 – < 4.1.8, < 3.6.12 | 4.2.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | ovirt-engine-wildfly +1 | 24.0.1-4.el9 | ELSA-2026-500571 |
| Oracle Linux 8 | ovirt-engine-wildfly +1 | 24.0.1-4.el8 | ELSA-2026-500570 |
Advisories 4
- WID-SEC-2026-2682 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ELSA-2026-500571 Important: ovirt-engine-wildfly security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 4, 2026
- ELSA-2026-500570 Important: ovirt-engine-wildfly security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 4, 2026
- WID-SEC-2026-2867 RealObjects PDFreactor: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 29, 2026
References
- https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy vendor-advisory