CVE-2026-108039— Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
Quick assessment
Affected
Apache Software Foundation Apache CXF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
默认情况下，StaxUtils 对 XML 文档中的元素总数或字符总数未设置任何限制。因此，在处理非常大的请求时，解析过程可能会消耗大量的内存和 CPU 资源，特别是在 CXF 从输入数据构建 DOM 的场景下（例如 SAAJ 或 WS-Security 场景）。如果未配置请求大小限制，则可能导致拒绝服务（DoS）攻击。 现在，这两项限制均设有默认值：最大元素计数为 100 × maxChildElements（默认值为 5,000,000），最大文档大小为 256M 字符。对于需要处理更大文档的应用程序，可以通过
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108039
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
Source: CVE Program / CVE List V5
Vulnerability Description
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 ~ 4.2.4 | - |
|
II. Public POCs for CVE-2026-108039
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108039
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-108039 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-09 · 13 CVEs total
| CVE-2026-103413 | 8.8 HIGH | Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes |
| CVE-2026-103412 | 8.8 HIGH | Apache Camel Karavan: project file name path traversal when committing a project to Git |
| CVE-2026-107938 | Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. | |
| CVE-2026-107937 | Apache CXF: The attachment header size and count limits can be bypassed, which allows deni | |
| CVE-2026-100227 | Apache CXF: XML Signature wrapping in JAX-RS XML Security | |
| CVE-2026-97791 | Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares valid | |
| CVE-2026-97468 | Apache CXF: Authentication bypass via weak cache keys for validated STS tokens | |
| CVE-2026-86463 | Apache CXF: FIQL Query Parser Denial of Service | |
| CVE-2026-79650 | Apache CXF: OIDC RP Open Redirect | |
| CVE-2026-78384 | Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompres | |
| CVE-2026-73179 | Apache CXF: JPA authorization-code consume is non-atomic | |
| CVE-2026-71575 | Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFil |
IV. Related Vulnerabilities
Same product: Apache CXF
-
CVE-2026-107938
Apache CXF: The Netty HTTP client transport does not perform -
CVE-2026-107937
Apache CXF: The attachment header size and count limits can -
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security -
CVE-2026-97791
Apache CXF: STSTokenValidator can accept untrusted SAML asse -
CVE-2026-97468
Apache CXF: Authentication bypass via weak cache keys for va
Same vendor: Apache Software Foundation
-
CVE-2026-103413
Apache Camel Karavan: unvalidated Kubernetes resources appli -
CVE-2026-103412
Apache Camel Karavan: project file name path traversal when -
CVE-2026-107938
Apache CXF: The Netty HTTP client transport does not perform -
CVE-2026-107937
Apache CXF: The attachment header size and count limits can -
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security
V. Comments for CVE-2026-108039
No comments yet