CVE-2026-57819— Apache CXF: No default restriction on the amount of form parameters per message
Quick assessment
Affected
Apache Software Foundation Apache CXF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache CXF 允许通过 “maxFormParameterCount” 配置选项设置 JAX-RS 消息中表单参数的数量上限。然而，如果没有设置默认限制，在处理包含大量表单参数的请求时，可能导致拒绝服务（DoS）攻击。建议用户升级到修复了该问题的版本，即 4.2.3、4.1.8 或 3.6.12，这些版本通过设置 500 个参数的默认上限来解决此问题。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0< 4.2.3 |
affected |
4.0.0< 4.1.8 |
affected | ||
< 3.6.12 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57819
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CXF: No default restriction on the amount of form parameters per message
Source: CVE Program / CVE List V5
Vulnerability Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 ~ 4.2.3 | - |
|
II. Public POCs for CVE-2026-57819
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57819
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-57819 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-06 · 18 CVEs total
| CVE-2026-64640 | 5.3 MEDIUM | Apache Polaris: register endpoint reads attacker-controlled storage location before allowe |
| CVE-2026-65583 | Apache CXF: Self-issued ID token claims validation skipped | |
| CVE-2025-49506 | Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack | |
| CVE-2026-32327 | Apache Portable Runtime Utility: apr-util XML stack recursion crash | |
| CVE-2026-34191 | Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle | |
| CVE-2026-34501 | Apache Portable Runtime Utility: Heap buffer overflow in APR redis client | |
| CVE-2026-34502 | Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client | |
| CVE-2026-57818 | Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider | |
| CVE-2026-61466 | Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation | |
| CVE-2026-63687 | Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters | |
| CVE-2026-68079 | Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay | |
| CVE-2026-68481 | Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider | |
| CVE-2026-65432 | Apache CXF: XXE via WSDL/XSD import parsing | |
| CVE-2026-57817 | Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow | |
| CVE-2026-66909 | Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage | |
| CVE-2026-64958 | Apache CXF: Denial of service via message header attachments | |
| CVE-2026-54225 | Apache CXF: Denial of Service attack via large attachments |
IV. Related Vulnerabilities
Same product: Apache CXF
-
CVE-2026-108039
Apache CXF: Prevent unbounded XML document size in StaxUtils -
CVE-2026-107938
Apache CXF: The Netty HTTP client transport does not perform -
CVE-2026-107937
Apache CXF: The attachment header size and count limits can -
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security -
CVE-2026-97791
Apache CXF: STSTokenValidator can accept untrusted SAML asse
Same vendor: Apache Software Foundation
-
CVE-2026-90436
Apache Axis 1.x (EOL): unauthenticated remote class instanti -
CVE-2026-85111
Apache James: Denial of service upon MIME parsing -
CVE-2026-85108
Apache James MIME4J: Denial of service due to Allocation of -
CVE-2026-76168
Apache James: ManageSieve file implementation cross-user pat -
CVE-2026-74756
Apache James: WebAdmin exposed without authentication on off
Same weakness: CWE-400
-
CVE-2026-17279
Multiple Vulnerabilities in IBM API Connect -
CVE-2026-59171
JSON-java: JSONTokener Unbounded Numeric String Resource-Exh -
CVE-2026-123356
GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows -
CVE-2026-102650
Nuxt Content: Unauthenticated SQLite Function DoS via Conten -
CVE-2026-123748
chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVo