REDHAT-BUG-2548457: High severity Apache CXF vulnerability

Q: Which deployments are most exposed to resource exhaustion?

Apache CXF applications that accept large XML requests are exposed, particularly when CXF builds a DOM from input through features such as SAAJ or WS-Security. The risk is greatest where no request-size limit is configured.

Q: What must an attacker send to trigger the issue?

An attacker needs to submit a very large XML request. Excessive element counts or total character counts can consume significant memory and CPU during XML parsing, potentially causing denial of service.

Q: Are installations protected by default after updating?

The fixed versions impose defaults of 5,000,000 maximum elements and 256M characters per XML document. Previously, StaxUtils applied no limit to either total element count or total XML character count by default.

Q: What can be done if the application legitimately needs larger XML documents?

Raise the limits using the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties as needed. Upgrading to 4.2.4, 4.1.9, or 3.6.13 provides the corrected default limits.

Published Oct 9, 2026

Updated

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected Software

1 affected component

Apache CXF<4.2.4, <4.1.9, <3.6.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.9
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.13
Configuration
Configure org.apache.cxf.stax.maxElementCount when processing larger documents.
Apache CXF StaxUtils org.apache.cxf.stax.maxElementCount = 5,000,000 by default (100 × maxChildElements)
Configuration
Configure org.apache.cxf.stax.maxXMLCharacters when processing larger documents.
Apache CXF StaxUtils org.apache.cxf.stax.maxXMLCharacters = 256M characters by default

Event History

Oct 9, 2026

Data Sourced

via Red Hat·10:31 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are most exposed to resource exhaustion?

Apache CXF applications that accept large XML requests are exposed, particularly when CXF builds a DOM from input through features such as SAAJ or WS-Security. The risk is greatest where no request-size limit is configured.

What must an attacker send to trigger the issue?

An attacker needs to submit a very large XML request. Excessive element counts or total character counts can consume significant memory and CPU during XML parsing, potentially causing denial of service.

Are installations protected by default after updating?

The fixed versions impose defaults of 5,000,000 maximum elements and 256M characters per XML document. Previously, StaxUtils applied no limit to either total element count or total XML character count by default.

What can be done if the application legitimately needs larger XML documents?

Raise the limits using the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties as needed. Upgrading to 4.2.4, 4.1.9, or 3.6.13 provides the corrected default limits.

REDHAT-BUG-2548457: High severity Apache CXF vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to resource exhaustion?

What must an attacker send to trigger the issue?

Are installations protected by default after updating?

What can be done if the application legitimately needs larger XML documents?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to resource exhaustion?

What must an attacker send to trigger the issue?

Are installations protected by default after updating?

What can be done if the application legitimately needs larger XML documents?