CVE-2026-57819
Received Received - Intake

Denial of Service in Apache CXF via Unlimited Form Parameters

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-57819
EUVD
EUVD-2026-53852

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
apache cxf to 4.2.3 (inc)
apache cxf to 4.1.8 (inc)
apache cxf to 3.6.12 (inc)
apache cxf 4.2.3
apache cxf 4.1.8
apache cxf 3.6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache CXF lacks a default limit on form parameters in JAX-RS messages. This allows attackers to send requests with an extremely high number of form parameters, causing a denial of service by consuming excessive server resources.

Detection Guidance

Check Apache CXF configuration files for the presence of form parameters without a set limit. Monitor for unusually high numbers of form parameters in requests, which may indicate an attempt to exploit this vulnerability.

Impact Analysis

This vulnerability can lead to system slowdowns or crashes due to resource exhaustion. Attackers may exploit it to make your services unavailable, affecting users and operations relying on Apache CXF.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It primarily poses a denial of service risk by allowing excessive form parameters, which could disrupt system availability. Compliance impacts would only occur if such disruptions led to violations of availability requirements in these standards.

Mitigation Strategies

Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12. Set the 'maxFormParameterCount' configuration option to a reasonable limit, such as 500, if not already configured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart