Denial of Service Vulnerability in Apache CXF by Apache

CVE-2026-54225

What is CVE-2026-54225?

The Apache CXF framework allows users to manage the size of message attachments through the configuration option 'attachment-max-size'. Prior to the releases 4.2.3, 4.1.8, and 3.6.12, there was no enforced limit on attachment sizes, which exposed users to potential denial of service (DoS) attacks. To mitigate this risk, users are strongly recommended to upgrade to versions 4.2.3, 4.1.8, or 3.6.12, which establish a default maximum attachment size of 50 MB, thus providing enhanced security against such attacks.

References