CVE-2026-108039
published 2026-10-09CVE-2026-108039: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.46%
38.8th percentile
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cxf | < 3.6.13 | 3.6.13 |
| apache | cxf | >= 4.0.0 < 4.1.9 | 4.1.9 |
| apache | cxf | >= 4.2.0 < 4.2.4 | 4.2.4 |
| apache_software_foundation | apache_cxf | < 3.6.13 | 3.6.13 |
| apache_software_foundation | apache_cxf | >= 4.0.0 < 4.1.9 | 4.1.9 |
| apache_software_foundation | apache_cxf | >= 4.2.0 < 4.2.4 | 4.2.4 |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.
ghsa_unreviewed·2026-10-09
CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Red Hat
org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing
vendor_redhat·2026-10-09·CVSS 7.5
CVE-2026-108039 [HIGH] CWE-770 org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing
org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing
A flaw was found in Apache CXF. By default, the XML parsing utility does not enforce limits on the total number of elements or characters within an incoming XML document. A remote attacker could exploit this vulnerability by sending an excessively large XML request, causing the application to consume excessive memory and CPU resources during processing, leading to a Denial of Service (DoS).
Package: cxf-core (Red Hat build of Apache Camel 4 for Quarkus 3) - Affected
Package: cxf-core (Red Hat build of Apache Camel for Spring Boot 4) - Affected
Package: cxf-core (Red Hat Fuse 7) - Affected
Package: cxf-core (Red Hat JBoss Enterprise Application Platform 7) - Out of support scope
Package: jboss-eap-7/ea
No detection rules found.
No public exploits indexed.
2026-10-09
Published