CVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per message
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57819?
CVE-2026-57819 is rated with a risk score of 29, indicating a vulnerability that may lead to denial of service attacks.
How do I fix CVE-2026-57819?
To mitigate CVE-2026-57819, set a limit on the number of form parameters using the 'maxFormParameterCount' configuration option in Apache CXF.
What kind of attacks does CVE-2026-57819 allow?
CVE-2026-57819 can potentially lead to denial of service (DoS) attacks by allowing requests with an excessive number of form parameters.
Which software is affected by CVE-2026-57819?
CVE-2026-57819 specifically affects the Apache CXF framework used for building web services.
When was CVE-2026-57819 published?
CVE-2026-57819 was published on August 6, 2026.