CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
Apache CXF adds default XML element and character limits to stop oversized documents exhausting memory.
32
Product
Apache CXF
- Mentions · 7d0
- Mentions · 30d11
- All mentions11
- First seenOct 9, 2026
- Last mentioned21d ago
Timeline
11 articles · newest firstCVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
Apache CXF Netty HTTP client skipped TLS hostname verification, enabling potential man-in-the-middle attacks.
55
CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
Apache CXF attachment header limits can be bypassed, allowing denial of service via memory exhaustion.
30
CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security
Apache CXF JAX-RS XML Security failed to bind signed XML, allowing signature-wrapping attacks.
50
CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
Apache CXF STSTokenValidator can accept untrusted SAML assertions by sharing validation state across requests.
55
CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF cached validated STS tokens under a 32-bit hash, enabling authentication bypass.
58
CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service
Apache CXF's FIQL query parser can be driven into denial of service by excessive operator search.
26
CVE-2026-79650: Apache CXF: OIDC RP Open Redirect
Apache CXF’s OIDC relying party can redirect authenticated users to an attacker-controlled URL.
46
CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
Apache CXF can expand a small attacker DEFLATE payload into gigabytes, causing a decompression-bomb denial of service.
48
CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic
Apache CXF's JPA OAuth2 provider can reuse one authorization code (CVE-2026-73179).
32
CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
Apache CXF's OIDC max_age freshness check failed due to a unit bug (CVE-2026-71575).
30
Related CVEs
by mentions- Inoperative max_age freshness check in Apache CXF OIDC
- Auth bypass via weak STS token cache keys in Apache CXF
- OAuth2 auth-code race in Apache CXF JPA provider
- CPU denial of service in Apache CXF FIQL parser
- XML Signature Wrapping in Apache CXF JAX-RS XML Security
- Apache CXF multipart header-limit bypass enables unauthenticated DoS
- Unbounded XML parsing DoS in Apache CXF StaxUtils
- Shared-state SAML trust bypass in Apache CXF
- Unbounded DEFLATE bomb in Apache CXF JOSE and SAML
- Open Redirect in Apache CXF OIDC Relying Party
Appears with
- Apache Software Foundationorganization · 11
- Apachevendor · 11
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.