CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service
Apache CXF's FIQL query parser can be driven into denial of service by excessive operator search.
26
CVE-2026-86463
CPU denial of service in Apache CXF FIQL parser
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF's FIQL query parser searches for operators in a way that can get stuck trying many combinations when it is given a long string with no operator, burning excessive CPU. An attacker who can send a crafted FIQL query can slow or stall other requests on the server, a denial of service, without gaining code execution or data access. The fix limits FIQL expressions to 4 KiB by default so normal queries still work while extremely long inputs are rejected. Users of Apache CXF should move to 4.2.4, 4.1.9, or 3.6.13. No public proof of concept is known, the issue is not in CISA KEV, and it has not yet been scored.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13, which cap FIQL expressions at 4 KiB by default. Until you upgrade, restrict or disable FIQL query endpoints exposed to untrusted clients and watch for CPU spikes tied to unusually long query strings.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF | Fixed in 3.6.13, 4.1.9, and 4.2.4; earlier releases in those lines are affected |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.