CVE-2026-57819
Apache CXF: No default restriction on the amount of form parameters per message
7.5 High
CVE-2026-57819 is a high vulnerability (CVSS 7.5) in Apache Cxf, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.73%EPSS, 54th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.73%Up 0.3 points since Aug 7, 2026
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.5.11 up to 3.5.11-tuxcare.11, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.103.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.4 Show 5 moreShow less3.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.83.5.11-tuxcare.9 | 3.5.11-tuxcare.11 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 5 CVEs | 3.5.11 up to 3.5.11-tuxcare.11, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.103.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.4 Show 5 moreShow less3.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.83.5.11-tuxcare.9 | 3.5.11-tuxcare.11 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 5 CVEs | 3.5.11 up to 3.5.11-tuxcare.11, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.103.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.4 Show 5 moreShow less3.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.83.5.11-tuxcare.9 | 3.5.11-tuxcare.11 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.5.9 up to 3.5.9-tuxcare.12, plus listed versions 3.5.9-tuxcare.103.5.9-tuxcare.113.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.4 Show 6 moreShow less3.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9-tuxcare.83.5.9-tuxcare.93.5.9.tuxcare.1 | 3.5.9-tuxcare.12 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 5 CVEs | 3.5.9 up to 3.5.9-tuxcare.12, plus listed versions 3.5.9-tuxcare.103.5.9-tuxcare.113.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.4 Show 6 moreShow less3.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9-tuxcare.83.5.9-tuxcare.93.5.9.tuxcare.1 | 3.5.9-tuxcare.12 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 5 CVEs | 3.5.9 up to 3.5.9-tuxcare.12, plus listed versions 3.5.9-tuxcare.103.5.9-tuxcare.113.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.4 Show 6 moreShow less3.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9-tuxcare.83.5.9-tuxcare.93.5.9.tuxcare.1 | 3.5.9-tuxcare.12 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
Show 116 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 12 CVEs | 3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 | 3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 7 CVEs | 3.0.12 up to 3.0.12-tuxcare.1 | 3.0.12-tuxcare.1 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 7 CVEs | 3.0.12 up to 3.0.12-tuxcare.1 | 3.0.12-tuxcare.1 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 7 CVEs | 3.0.12 up to 3.0.12-tuxcare.1 | 3.0.12-tuxcare.1 |
eap8-apache-cxfRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el9eap | 0:4.1.8-1.redhat_00001.1.el9eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el9eap | 0:4.1.138-1.Final_redhat_00001.1.el9eap |
eap8-resteasyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-cdiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-client-apiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-coreRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-core-spiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-resteasy-validator-providerRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el9eap | 0:6.2.19-1.Final_redhat_00002.1.el9eap |
eap8-apache-cxfRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el8eap | 0:4.1.8-1.redhat_00001.1.el8eap |
eap8-apache-sshdRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:2.19.0-1.redhat_00001.1.el8eap | 0:2.19.0-1.redhat_00001.1.el8eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el8eap | 0:4.1.138-1.Final_redhat_00001.1.el8eap |
eap8-resteasyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-cdiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-client-apiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-coreRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-core-spiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-resteasy-validator-providerRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el8eap | 0:6.2.19-1.Final_redhat_00002.1.el8eap |
eap8-apache-cxfRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-apache-cxf-rtRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.8-1.redhat_00001.1.el10eap | 0:4.1.8-1.redhat_00001.1.el10eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:4.1.138-1.Final_redhat_00001.1.el10eap | 0:4.1.138-1.Final_redhat_00001.1.el10eap |
eap8-resteasyRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-cdiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-clientRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-client-apiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-coreRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-core-spiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-cryptoRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-jsapiRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
eap8-resteasy-validator-providerRed Hat:jboss_enterprise_application_platform:8.1::el10 From an advisory covering 5 CVEs | before 0:6.2.19-1.Final_redhat_00002.1.el10eap | 0:6.2.19-1.Final_redhat_00002.1.el10eap |
What each source reports
CVE List Score used
Apache CXF: No default restriction on the amount of form parameters per message
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
- Record
CVE-2026-57819- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-53852
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
- Record
EUVD-2026-53852- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rqrh-ghmh-74j5
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the ...
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
- Record
GHSA-rqrh-ghmh-74j5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
- Record
CVE-2026-57819- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Apache CXF: No default restriction on the amount of form parameters per message
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
- Record
CVE-2026-57819- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVRHSA-2026:92056
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:92056- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-13
Show 6 moreShow less
OSVRHSA-2026:92057
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:92057- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-13
OSVRHSA-2026:92059
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
- Record
RHSA-2026:92059- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-13
OSVCLSA-2026-1793898246No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.11.
- Record
CLSA-2026-1793898246- Updated
- 2026-11-06
OSVCLSA-2026-1793982274No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.9-tuxcare.12.
- Record
CLSA-2026-1793982274- Updated
- 2026-11-06
OSVCLSA-2026-1794008495No score
TuxCare security update for 8 packages (12 CVEs)
TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1794008495- Updated
- 2026-11-07
OSVCLSA-2026-1794218709No score
TuxCare security update for org.apache.cxf (7 CVEs)
TuxCare rebuilt 3 org.apache.cxf packages to address 7 CVEs. Fixed in 3.0.12-tuxcare.1.
- Record
CLSA-2026-1794218709- Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov
openwall.com/lists/oss-security/2026/08/06/15
nvd.nist.gov/vuln/detail/CVE-2026-57819
github.com/advisories/GHSA-rqrh-ghmh-74j5
repo.maven.apache.org/maven2
Show 44 moreShow less
access.redhat.com/errata/RHSA-2026:92056
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
bugzilla.redhat.com/show_bug.cgi?id=2511978
issues.redhat.com/browse/JBEAP-34960
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92056.json
cve.org/CVERecord?id=CVE-2026-57819