CVE-2026-57819

CVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per message

Vendor Apache Software Foundation
Product Apache CXF
Weakness CWE-400
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

Key dates

02Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-35909 WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack CVE-2025-50057 Extension - rsjoomla.com - DOS vulnerability RSFiles! component 1.16.3-1.17.7 for Joomla CVE-2026-7493 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service CVE-2021-24893 Stars Rating < 3.5.1 - Comments Denial of Service CVE-2024-12579 Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service