High severity · published Aug 6, 2026
CVE-2026-57819
Apache CXF: No default restriction on the amount of form parameters per message
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CXF · Apache Software Foundation
4.2.0 before 4.2.3; 4.0.0 before 4.1.8; before 3.6.12 · source: vendor
CX
Cxf · Apache
before 3.6.12; 4.0.0 before 4.1.8; 4.2.0 before 4.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57819
Mailing List
https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/08/06/15
More from Apache CXF
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository