CVE-2026-108039
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
- Record
CVE-2026-108039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-776
- Updated
- 2026-11-02
EUVDEUVD-2026-95704
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
- Record
EUVD-2026-95704- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v2mw-x6g2-24jf
By default, StaxUtils placed no limit on the total number of elements or the total number of...
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
- Record
GHSA-v2mw-x6g2-24jf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-776
- Updated
- 2026-11-02
NVD
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
- Record
CVE-2026-108039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-776
- Updated
- 2026-11-02
OSV
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
- Record
CVE-2026-108039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1793898246 No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.11.
- Record
CLSA-2026-1793898246- Updated
- 2026-11-06
OSVCLSA-2026-1793982274 No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.9-tuxcare.12.
- Record
CLSA-2026-1793982274- Updated
- 2026-11-06
OSVCLSA-2026-1794008495 No score
TuxCare security update for 8 packages (12 CVEs)
TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1794008495- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.11, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.103.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.4 Show 5 moreShow less3.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.83.5.11-tuxcare.9 |
3.5.11-tuxcare.11 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.11, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.103.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.4 Show 5 moreShow less3.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.83.5.11-tuxcare.9 |
3.5.11-tuxcare.11 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.11, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.103.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.4 Show 5 moreShow less3.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.83.5.11-tuxcare.9 |
3.5.11-tuxcare.11 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.5.9 up to 3.5.9-tuxcare.12, plus listed versions 3.5.9-tuxcare.103.5.9-tuxcare.113.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.4 Show 6 moreShow less3.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9-tuxcare.83.5.9-tuxcare.93.5.9.tuxcare.1 |
3.5.9-tuxcare.12 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 5 CVEs |
3.5.9 up to 3.5.9-tuxcare.12, plus listed versions 3.5.9-tuxcare.103.5.9-tuxcare.113.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.4 Show 6 moreShow less3.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9-tuxcare.83.5.9-tuxcare.93.5.9.tuxcare.1 |
3.5.9-tuxcare.12 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 5 CVEs |
3.5.9 up to 3.5.9-tuxcare.12, plus listed versions 3.5.9-tuxcare.103.5.9-tuxcare.113.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.4 Show 6 moreShow less3.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9-tuxcare.83.5.9-tuxcare.93.5.9.tuxcare.1 |
3.5.9-tuxcare.12 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108039 is a high vulnerability (CVSS 7.5) in Apache Cxf, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. No source names a fixed version.