CVE-2026-57819 Details
Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
A denial-of-service vulnerability has been identified in Apache CXF's JAX-RS frontend, specifically in versions 4.2.0 prior to 4.2.3, 4.0.0 prior to 4.1.8, and all versions prior to 3.6.12. The issue arises because, although the 'maxFormParameterCount' configuration option allows users to set a limit on the number of form parameters in a JAX-RS message, no default limit is established. This lack of a default can lead to denial-of-service attacks by processing requests with an excessively large number of form parameters.
Users are advised to upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12, all of which address this vulnerability by implementing a default limit of 500 form parameters.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/06/15 | CVE | |
| https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache cxf | < 3.6.12 >= 4.0.0, < 4.1.8 >= 4.2.0, < 4.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CVE |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |