NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#cxf

0 stories this week · 5 this month · 5 in 6 months · mostly security

Stories per day · 30 days

Relatedapache5 denial-of-service2 oidc2 authorization-code1 cve-2026-1080391 cve-2026-715751 cve-2026-731791 cve-2026-783841 cve-2026-796501 decompression-bomb1 jwe1 oauth1 oauth21 open-redirect1 saml1 staxutils1 xml1

2 stories, newest first · one card per story

oss-security21d ago

CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

Apache CXF adds default XML element and character limits to stop oversized documents exhausting memory.

2 sources apache cxf

2

oss-security21d ago

CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

Apache CXF can expand a small attacker DEFLATE payload into gigabytes, causing a decompression-bomb denial of service.

9 sources apache cxf

2