CVE-2026-54225 Details
Description
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.
A denial-of-service vulnerability has been identified in Apache CXF versions 4.2.0 prior to 4.2.3, 4.0.0 prior to 4.1.8, and versions prior to 3.6.12. The issue arises because there was no default limit on attachment sizes, allowing for potential denial-of-service attacks if users did not manually set a size limit. The vulnerability can be exploited by sending large attachments, overwhelming the server and causing service disruptions.
Users are advised to update to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12, all of which address this vulnerability by introducing a default attachment size limit of 50 MB.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/06/14 | CVE | |
| https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache cxf | < 3.6.12 >= 4.0.0, < 4.1.8 >= 4.2.0, < 4.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CVE |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |