CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service
AI summary · grok-4.7Summaries by Vani AI
Apache CXF's FIQL query parser can be driven into denial of service by excessive operator search.
Apache CXF's FIQL query parser in cxf-rt-rs-extension-search can get stuck trying many operator combinations while searching query expressions, causing denial of service. Apache rates CVE-2026-86463 low. Affected versions are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13. The advisory does not report exploitation in the wild.
Key facts
- FIQL parser can loop over many operator combinations in a query.
- Apache rates CVE-2026-86463 low in cxf-rt-rs-extension-search.
- Fixed in CXF 3.6.13, 4.1.9, and 4.2.4.
- CVEs
- CVE-2026-86463
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86463 | CPU denial of service in Apache CXF FIQL parser | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: low Affected versions: - Apache CXF (org. apache. cxf:cxf-rt-rs-extension-search) 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.