CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
Apache CXF adds default XML element and character limits to stop oversized documents exhausting memory.
32
Vulnerability2 · 1 read
CVE-2026-108039
Unbounded XML parsing DoS in Apache CXF StaxUtils
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF's StaxUtils previously imposed no default cap on the total number of XML elements or characters in a document. A very large request can therefore consume excessive memory and CPU while parsing, especially when CXF builds a DOM (for example via SAAJ or WS-Security), and can deny service if no separate request-size limit is configured. Fixed releases default the element cap to 100 times maxChildElements (5,000,000) and the document size to 256 million characters; larger documents can be allowed via org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters. Anyone running Apache CXF web-service endpoints that accept XML without an external size limit is affected. There is no known public proof of concept and no CISA KEV listing; CVSS has not yet been scored.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, enforce a request-body size limit in front of CXF (container, gateway, or application) so unbounded XML cannot be parsed. If legitimate documents exceed the new defaults, raise only org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters as needed.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF | Releases before the fixes in 3.6.13, 4.1.9, and 4.2.4 (those versions and the stated upgrade targets include the limits) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.