CVE-2026-54225Apache CXF: Denial of Service attack via large attachments

Beschreibung

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy vendor-advisoryMailing ListVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/08/06/14