CVE-2026-108039

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13

Description StaxUtils does not impose limits on the total number of elements or characters in an XML document by default. This allows a very large request to consume excessive memory and CPU during parsing, particularly when the system builds a Document Object Model (DOM)—a tree-like representation of an XML document—from the input, such as in SAAJ or WS-Security. This resource exhaustion can lead to a denial of service if no request size limit is configured.

Recommendations Upgrade to version 4.2.4. Upgrade to version 4.1.9. Upgrade to version 3.6.13. Increase the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties for applications that must process documents larger than the default limits.