Loading vulnerability…
Denial of Service via Uncontrolled Form Parameters in Apache CXF
CVE-2026-57819 is a resource-consumption vulnerability in Apache CXF's JAX-RS frontend. Although the maxFormParameterCount configuration option supports limiting form parameters, affected versions impose no default limit. Processing requests containing very large numbers of form parameters can therefore cause denial of service. Affected releases include versions before 3.6.12, versions 4.0.0 through versions before 4.1.8, and versions 4.2.0 through versions before 4.2.3. Fixed releases introduce a default limit of 500 form parameters.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Excessive resource consumption during form-parameter processing can degrade service availability or cause denial of service in affected applications. Remote, unauthenticated exploitation is possible where the vulnerable request-processing functionality is accessible without authentication. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
Explicitly configure maxFormParameterCount to a finite value appropriate for the application; 500 matches the default introduced by the fixed releases. Until patching is complete, restrict access to affected endpoints to trusted clients where feasible and enforce request limits at an upstream proxy. These measures do not replace installing the fixed release.
Patch, then assume compromise.
Upgrade Apache CXF to the applicable fixed release: 3.6.12, 4.1.8, or 4.2.3, or a later fixed release in the corresponding supported branch. These releases establish a default maximum of 500 form parameters. For Red Hat JBoss EAP 8.1 deployments, apply the EAP 8.1.9 updates under RHSA-2026:92057 for RHEL 8, RHSA-2026:92056 for RHEL 9, or RHSA-2026:92059 for RHEL 10. For products embedding CXF through IBM WebSphere, apply the applicable vendor-provided component fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.