Description

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T11:16:30.237Z",
  "pubdate": "2026-08-06T11:16:30.237Z",
  "executiveSummary": "This vulnerability involves a resource exhaustion flaw in Apache CXF impacting JAX-RS message processing capabilities. Specifically, the application fails to enforce a default upper limit on the number of accepted form parameters within incoming HTTP requests by default.\nThe primary impact of this vulnerability is a Denial of Service (DoS), where an unauthenticated remote attacker can exhaust server memory and computational resources by submitting crafted requests containing excessively large numbers of form parameters.\nAffected systems include Apache CXF deployments utilizing JAX-RS endpoints prior to the patched versions. The risk implication is significant as it exposes web services to application-layer resource starvation attacks without requiring specialized privileges or prior system access.\nExploitation requirements are minimal, relying solely on the ability to transmit HTTP POST requests containing multipart or URL-encoded form data directly to vulnerable endpoints exposed over the network.\nTo resolve this exposure, administrators and developers must upgrade the affected Apache CXF libraries to the designated secure versions which implement a sensible default parameter constraint, or explicitly enforce configuration limits within their application architecture.",
  "technicalDetails": "The root cause of this vulnerability lies in the absence of a restrictive default threshold for the 'maxFormParameterCount' configuration property within the JAX-RS message processing component of Apache CXF. When processing HTTP requests containing form parameters, the framework parses and stores these elements in memory without boundary enforcement.\nThe vulnerable component resides in the parameter parsing and binding logic of Apache CXF JAX-RS handlers. Network exposure is present wherever JAX-RS endpoints accept form data from remote clients, typically over HTTP or HTTPS protocols.\nAuthentication and privilege requirements are absent; any remote adversary capable of establishing a network connection to the target service can initiate the attack vector without valid credentials or elevated permissions.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTTP request containing an extraordinarily high volume of form parameters within the request body or query string. Second, the client transmits this payload to a vulnerable Apache CXF JAX-RS endpoint. Third, the framework attempts to parse, instantiate, and store all provided parameters in memory to bind them to method arguments or message context. Fourth, the unbounded parsing operation consumes excessive CPU cycles and memory resources. Finally, the target server becomes unresponsive, resulting in a Denial of Service for legitimate users.\nPayload behavior centers on resource exhaustion. The sheer volume of parameters forces the Java Virtual Machine (JVM) to allocate extensive memory structures, potentially triggering OutOfMemoryError exceptions and application crashes.\nAffected software versions include Apache CXF releases preceding versions 4.2.3, 4.1.8, and 3.6.12. Post-exploitation impact is generally limited to service disruption and application instability rather than arbitrary code execution or data exfiltration, but it severely degrades system availability."
}