CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service

Apache CXF's FIQL query parser contains a denial of service vulnerability in versions 3.6.x before 3.6.13, 4.0.x and 4.1.x before 4.1.9, and 4.2.x before 4.2.4. The flaw allows the search pattern to hang while processing certain query expressions, causing performance degradation.

Why it matters: Organizations running affected Apache CXF versions with FIQL search capabilities enabled should update to patched releases to prevent attackers from crafting malicious queries that degrade application availability.

Source published

2026-10-09 10:19 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC