{"id":"CVE-2026-57819","aliases":["CLSA-2026-1793898246","CLSA-2026-1793982274","CLSA-2026-1794008495","CLSA-2026-1794218709","EUVD-2026-53852","GHSA-rqrh-ghmh-74j5"],"status":"published","title":"Apache CXF: No default restriction on the amount of form parameters per message","description":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00732,"percentile":0.5482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2026-08-06T10:12:26Z","modified":"2026-11-09T19:15:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-integration-jca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-transports-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/06/15","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57819","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rqrh-ghmh-74j5"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57819.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57819","title":"Apache CXF: No default restriction on the amount of form parameters per message","description":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.","status":"published","published":"2026-08-06T10:12:26.243Z","modified":"2026-08-07T00:01:43.594Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-53852","description":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.","status":"published","published":"2026-08-06T10:12:26Z","modified":"2026-08-07T00:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-rqrh-ghmh-74j5","title":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the ...","description":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.","status":"published","published":"2026-08-06T12:31:13Z","modified":"2026-08-07T00:32:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:10:11.041675Z"}],"nvd":[{"id":"CVE-2026-57819","description":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.","status":"published","published":"2026-08-06T11:16:30.237Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-57819","title":"Apache CXF: No default restriction on the amount of form parameters per message","description":"Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the \"maxFormParameterCount\" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.","status":"published","published":"2026-08-06T10:12:26.243Z","modified":"2026-10-28T02:31:12.962512488Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"CLSA-2026-1793898246","title":"TuxCare security update for org.apache.cxf (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.11.","status":"published","published":"2026-11-05T18:04:07Z","modified":"2026-11-06T13:15:13.999108Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793982274","title":"TuxCare security update for org.apache.cxf (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.9-tuxcare.12.","status":"published","published":"2026-11-06T17:24:35Z","modified":"2026-11-06T19:00:05.26274921Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794008495","title":"TuxCare security update for 8 packages (12 CVEs)","description":"TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.","status":"published","published":"2026-11-07T00:41:36Z","modified":"2026-11-07T07:15:03.24809114Z","updated_at":"2026-11-07T07:40:28.517244Z"},{"id":"CLSA-2026-1794218709","title":"TuxCare security update for org.apache.cxf (7 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 7 CVEs. Fixed in 3.0.12-tuxcare.1.","status":"published","published":"2026-11-09T11:05:10Z","modified":"2026-11-09T19:15:02.890791072Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}