https://seclists.org/oss-sec/2026/q4/116: CVE-2026-108039: Apache CXF: Pvent unbounded XML document size in StaxUtils by adding default element and character limits

Q: Which deployments are most exposed to this issue?

Deployments that accept large XML requests without a request-size limit are exposed, particularly when CXF builds a DOM from the input, such as with SAAJ or WS-Security processing. A very large request can consume substantial memory and CPU during parsing and cause denial of service.

Q: What does an attacker need to exploit it?

An attacker needs to be able to submit a very large XML request to the affected CXF application. The issue is most relevant when no request-size limit is configured.

Q: Are default configurations affected?

Before the fixed releases, StaxUtils imposed no default total element-count or total character-count limit on XML documents. The fixes introduce defaults of 100 times maxChildElements for element count, with maxChildElements defaulting to 5,000,000, and 256M characters for document size.

Q: What can be done if upgrading is not immediately possible?

Configure request-size limits to prevent oversized XML input from reaching CXF parsing. Applications that need to process larger documents can adjust org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters, but increasing these limits permits larger inputs and associated resource use.

Q: Which releases contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. Affected release ranges are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and releases before 3.6.13.

Published Oct 9, 2026

Updated

Affected Software

1 affected component

Apache CXF>=4.2.0<4.2.4, >=4.0.0<4.1.9, <3.6.13

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments that accept large XML requests without a request-size limit are exposed, particularly when CXF builds a DOM from the input, such as with SAAJ or WS-Security processing. A very large request can consume substantial memory and CPU during parsing and cause denial of service.

What does an attacker need to exploit it?

An attacker needs to be able to submit a very large XML request to the affected CXF application. The issue is most relevant when no request-size limit is configured.

Are default configurations affected?

Before the fixed releases, StaxUtils imposed no default total element-count or total character-count limit on XML documents. The fixes introduce defaults of 100 times maxChildElements for element count, with maxChildElements defaulting to 5,000,000, and 256M characters for document size.

What can be done if upgrading is not immediately possible?

Configure request-size limits to prevent oversized XML input from reaching CXF parsing. Applications that need to process larger documents can adjust org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters, but increasing these limits permits larger inputs and associated resource use.

Which releases contain the fix?