CVE-2026-57819— Apache CXF: No default restriction on the amount of form parameters per message
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0< 4.2.3 | affected |
4.0.0< 4.1.8 | affected | ||
< 3.6.12 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57819
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CXF: No default restriction on the amount of form parameters per message
Source: CVE Program / CVE List V5
Vulnerability Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 ~ 4.2.3 | - |
II. Public POCs for CVE-2026-57819
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57819
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-57819 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-06 · 18 CVEs total
| CVE-2026-64640 | 5.3 MEDIUM | Apache Polaris: register endpoint reads attacker-controlled storage location before allowe |
| CVE-2026-65583 | Apache CXF: Self-issued ID token claims validation skipped | |
| CVE-2025-49506 | Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack | |
| CVE-2026-32327 | Apache Portable Runtime Utility: apr-util XML stack recursion crash | |
| CVE-2026-34191 | Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle | |
| CVE-2026-34501 | Apache Portable Runtime Utility: Heap buffer overflow in APR redis client | |
| CVE-2026-34502 | Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client | |
| CVE-2026-57818 | Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider | |
| CVE-2026-61466 | Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation | |
| CVE-2026-63687 | Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters | |
| CVE-2026-68079 | Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay | |
| CVE-2026-68481 | Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider | |
| CVE-2026-65432 | Apache CXF: XXE via WSDL/XSD import parsing | |
| CVE-2026-57817 | Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow | |
| CVE-2026-66909 | Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage | |
| CVE-2026-64958 | Apache CXF: Denial of service via message header attachments | |
| CVE-2026-54225 | Apache CXF: Denial of Service attack via large attachments |
IV. Related Vulnerabilities
Same product: Apache CXF
- CVE-2026-57818
Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in J - CVE-2026-61466
Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Es - CVE-2026-63687
Apache CXF: JwtRequestCodeFilter silently overrides outer PK - CVE-2026-65583
Apache CXF: Self-issued ID token claims validation skipped - CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimit
Same vendor: Apache Software Foundation
- CVE-2026-61899
Apache Tapestry: Possible classpath file download through UR - CVE-2026-28672
Apache Ranger: OS Command Injection via Username in UnixUser - CVE-2026-32227
Apache Ranger: SQL Injection vulnerability in lookup functio - CVE-2026-40920
Apache Ranger: Privilege Escalation via URL Parameter - CVE-2026-42537
Apache Ranger: Remote Code Execution via JDBC URL Injection
Same weakness: CWE-400
- CVE-2026-52880
Klever-Go: REST API slow-header connection exhaustion via Gi - CVE-2026-52879
Klever-Go: Unbounded goroutine spawn on direct-message ingre - CVE-2026-49343
Klever-Go KVM: Throttler slot leak in trie account-data sync - CVE-2026-47249
Klever-Go KVM: Hash-array amplification in P2P resolver requ - CVE-2026-54338
JupyterHub: Unauthenticated Denial of Service via Unbounded
V. Comments for CVE-2026-57819
No comments yet