CVE-2026-54225
Received Received - Intake

Denial of Service via Unrestricted Attachment Size in Apache CXF

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-54225
EUVD
EUVD-2026-53851

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache cxf 4.2.3
apache cxf 4.1.8
apache cxf 3.6.12
apache cxf to 4.2.3|end_excluding=4.1.8|end_excluding=3.6.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache CXF is a framework for building web services. This vulnerability allows an attacker to perform a denial of service by sending attachments larger than the default limit. The issue occurs because prior to versions 4.2.3, 4.1.8, and 3.6.12, there was no default maximum attachment size set.

Detection Guidance

Check Apache CXF version with commands like 'cxf-rt-rs-client jar' or 'find / -name cxf*.jar'. If version is below 4.2.3, 4.1.8, or 3.6.12, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could cause a denial of service by consuming excessive server resources. This may lead to degraded performance or complete service unavailability for legitimate users.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial of service attacks through unbounded attachment sizes. Uncontrolled attachment sizes may lead to resource exhaustion, affecting system availability and integrity, which are key requirements under these regulations.

Mitigation Strategies

Update Apache CXF to version 4.2.3 or 4.1.8 or 3.6.12. If updating is not possible, manually set the 'attachment-max-size' limit to 50MB in your configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart