CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.4 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.13 - Configuration
Configure org.apache.cxf.stax.maxElementCount to limit the total number of XML elements; the default is 100 × maxChildElements, or 5,000,000 by default.
Apache CXF StaxUtils org.apache.cxf.stax.maxElementCount = 100 × maxChildElements (5,000,000 by default) - Configuration
Configure org.apache.cxf.stax.maxXMLCharacters to limit the maximum XML document size to 256M characters by default.
Apache CXF StaxUtils org.apache.cxf.stax.maxXMLCharacters = 256M characters
Event History
Frequently Asked Questions
Which deployments are most exposed to this denial-of-service condition?
CXF deployments that accept large XML requests without a request-size limit are exposed, particularly when processing builds a DOM from input, such as with SAAJ or WS-Security. Large documents can consume substantial memory and CPU during parsing.
What configuration changes after applying the fix?
The fix introduces default limits of 5,000,000 elements, calculated as 100 times the default maxChildElements value, and 256M XML characters. Applications that legitimately process larger XML documents can raise these limits with org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters.
What should be done if an application cannot be upgraded immediately?
Configure request-size limits to restrict the size of accepted XML input. This is especially important for endpoints that use SAAJ, WS-Security, or other processing that builds a DOM from the request.
Which Apache CXF versions contain the fix?
The recommended fixed versions are 4.2.4, 4.1.9, and 3.6.13.