CLEANSTART-2026-PW92268: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document
Published Nov 13, 2026
·Updated
Security vulnerability affects the wso2am package. By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.
Affected Software
1 affected componentFixes available
cleanstart/wso2am<4.7.0-r4
4.7.0-r4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4
Event History
Nov 13, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What level of access does an attacker need?
The issue is network-reachable and requires no privileges or user interaction. An unauthenticated remote attacker can target an affected deployment.
2
What is the expected security impact?
The reported impact is high on availability. No confidentiality or integrity impact is indicated.
3
Are default deployments affected?
Yes. The lack of limits on XML element count and total character count is reported to occur by default.