CVE-2026-108039
Apache Cxf: denial of service
- Risk score
- 58/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of se…
- Affected
- Apache Cxf before 4.2.4, 4.1.9, 3.6.13
- Fix
- Upgrade Apache Cxf to 4.2.4, 4.1.9 or 3.6.13 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Cxf: Amber, patch this week. The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication pol…
The flaws
- CVE-2026-108039: Denial of service (CVSS 7.5 · EPSS 0%)
- CVE-2026-71575: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a… (CVSS 9.1 · EPSS 0%)
- CVE-2026-97468: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens… (CVSS 9.1 · EPSS 0%)
- CVE-2026-107938: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not… (CVSS 9.1 · EPSS 0%)
The fix
Upgrade Apache Cxf: 4.2.4 · 4.1.9 · 3.6.13 or later on your release line
Who is exposed: Apache Cxf before 4.2.4, 4.1.9, 3.6.13
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-776 (CWE-776). 4 other warnings in 30 days
- Same product: Earlier Apache Cxf warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Last activity 9 Oct 2026. Patch Forecast updates every hour.