CLEANSTART-2026-ZI24717: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document

Q: Are default deployments affected?

Yes. The issue is present by default because StaxUtils does not impose limits on the total number of XML elements or characters.

Q: Does exploitation require authentication or user interaction?

No. The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

Q: What is the expected security impact?

The supplied vector indicates a high availability impact, with no indicated confidentiality or integrity impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the wso2am package. By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.

Affected Software

1 affected componentFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-108039

Frequently Asked Questions

Are default deployments affected?

Yes. The issue is present by default because StaxUtils does not impose limits on the total number of XML elements or characters.

Does exploitation require authentication or user interaction?

No. The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

What is the expected security impact?

The supplied vector indicates a high availability impact, with no indicated confidentiality or integrity impact.

CLEANSTART-2026-ZI24717: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Are default deployments affected?

Does exploitation require authentication or user interaction?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Are default deployments affected?

Does exploitation require authentication or user interaction?

What is the expected security impact?