CVSS
7.5
CVSS v3.1
EPSS
0.5%
Exploit Prediction Score
Published
August 6, 2026
Exploitability
EPSS probability 0.5%
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).