PT-2026-68462

CVE-2026-57819

Published

2026-08-06

Updated

2026-09-18

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description Lack of a default limit on the number of form parameters in a JAX-RS message can lead to denial of service attacks when processing requests containing an excessive amount of form parameters. This is controlled by the maxFormParameterCount configuration option.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

Related identifiers

CVE-2026-57819

CLEANSTART-2026-AH35927