CVE-2026-108039

Overview

Apache CXF is an open-source services framework, maintained by the Apache Software Foundation, for building and consuming web services in Java. It implements the JAX-WS and JAX-RS APIs and supports SOAP, the WS-* standards, RESTful HTTP, and OAuth 2.0 over transports such as HTTP and JMS. Its modules are published as Maven artifacts under org.apache.cxf.

A denial of service vulnerability (CVE-2026-108039) has been identified in the StaxUtils XML parsing utility of Apache CXF, which allows attackers to exhaust server memory and CPU by sending a very large XML document. By default, no limit is placed on the total number of elements or the total number of characters in a parsed document.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache CXF.

Details

Module Info

• Product: Apache CXF
• Affected packages: org.apache.cxf:cxf-core
• Affected versions: <3.6.13, >=4.0.0 <4.1.9, >=4.2.0 <4.2.4
• GitHub repository: https://github.com/apache/cxf
• Published packages: https://central.sonatype.com/artifact/org.apache.cxf/cxf-core
• Package manager: Maven
• Fixed in:
  • OSS Apache CXF 3.6.13, 4.1.9, 4.2.4
  • NES for Apache CXF v3.4.13, v3.5.14

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.cxf:cxf-core package in multiple versions of Apache CXF. StaxUtils creates the Woodstox XMLInputFactory instances that CXF uses to read incoming XML, and applies a set of parser limits to them. Two of those limits, the total element count and the total character count of a document, default to Long.MAX_VALUE unless the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties are set:

private static final long MAX_ELEMENT_COUNT_VAL =
        getLong(MAX_ELEMENT_COUNT, Long.MAX_VALUE);
private static final long MAX_XML_CHARS_VAL =
        getLong(MAX_XML_CHARACTERS, Long.MAX_VALUE);

These values are passed straight to Woodstox in setRestrictionProperties():

&& setProperty(factory, P_MAX_ELEMENT_COUNT, MAX_ELEMENT_COUNT_VAL)
&& setProperty(factory, P_MAX_ELEMENT_DEPTH, MAX_ELEMENT_DEPTH_VAL)
&& setProperty(factory, P_MAX_CHARACTERS, MAX_XML_CHARS_VAL)

Because both limits are effectively unbounded, the per-element limits (child elements, depth, attribute count and size, text length) are the only constraints the parser enforces. An attacker can stay within each of them while sending a document with an extremely large number of elements or characters overall. CXF parses the whole request, and where it builds a DOM from the input (for example for SAAJ or WS-Security processing) the entire document is held in memory. When no request size limit is configured elsewhere, a single large request can use a lot of memory and CPU and deny service to legitimate clients.

Mitigation

Only recent versions of Apache CXF are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache CXF release line (3.6.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Wanxin Yin from yaklang.io (finder)