CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
Apache CXF adds default XML element and character limits to stop oversized documents exhausting memory.
Apache disclosed CVE-2026-108039, a low-severity flaw in Apache CXF where StaxUtils placed no default limit on the number of XML elements or characters. A very large request can consume substantial memory and CPU during parsing, especially when CXF builds a DOM for SAAJ or WS-Security. Affected lines are CXF 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13. The fix adds default element and character limits.
- CVE-2026-108039 is rated low severity by Apache.
- StaxUtils had no default cap on XML elements or characters.
- Oversized documents can exhaust memory and CPU during DOM parsing.
- Fixes are in CXF 4.2.4, 4.1.9, and 3.6.13.
- CVEs
- CVE-2026-108039
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108039 | Unbounded XML parsing DoS in Apache CXF StaxUtils | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: low Affected versions: - Apache CXF 4. 2. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.