Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – < 4.2.3, 4.0.0 – < 4.1.8, < 3.6.12 | 4.2.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.1.8-1.redhat_00001.1.el8eap | RHSA-2026:92059, RHSA-2026:92057, RHSA-2026:92056 |
| Red Hat JBoss EAP 8 | eap8-apache-sshd | 2.19.0-1.redhat_00001.1.el8eap | RHSA-2026:92057 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.138-1.Final_redhat_00001.1.el8eap | RHSA-2026:92059, RHSA-2026:92057, RHSA-2026:92056 |
| Red Hat JBoss EAP 8 | eap8-resteasy +15 | 6.2.19-1.Final_redhat_00002.1.el8eap | RHSA-2026:92059, RHSA-2026:92057, RHSA-2026:92056 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | ovirt-engine-wildfly +1 | 24.0.1-4.el9 | ELSA-2026-500571 |
| Oracle Linux 8 | ovirt-engine-wildfly +1 | 24.0.1-4.el8 | ELSA-2026-500570 |
Advisories 7
- RHSA-2026:92056 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92059 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92057 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2682 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ELSA-2026-500571 Important: ovirt-engine-wildfly security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 4, 2026
- ELSA-2026-500570 Important: ovirt-engine-wildfly security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 4, 2026
- WID-SEC-2026-2867 RealObjects PDFreactor: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 29, 2026
References
- https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov vendor-advisory