CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9858

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

Apache CXF had no default limits on XML document element count or character size in StaxUtils, allowing large requests to consume excessive memory and CPU during parsing. The vulnerability affects CXF versions 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and 3.6.12 and earlier, with patches available in newer releases.

Why it matters: Organizations running Apache CXF with SAAJ or WS-Security features are exposed to denial of service attacks via malformed XML; patching to CXF 4.2.4, 4.1.9, or 3.6.13 is necessary.

CVEsCVE-2026-108039
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary