CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

High 7.5 Published 9 Oct 2026 Updated 15 Oct 2026

Attackers can cause denial of service by sending large XML documents to Apache CXF, which previously lacked default parsing limits.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-108039?

CVE-2026-108039 is a high-severity denial of service vulnerability in Apache Cxf, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Weakness: CWE-776

Which versions are affected by CVE-2026-108039?

It affects 1 product.

Products include Apache Cxf.

How do I fix CVE-2026-108039?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-108039 being exploited?

There is no known exploitation of CVE-2026-108039 in the wild and no public exploit code.

All Apache Cxf vulnerabilities

Sources

Also known as CLEANSTART-2026-IW56621, GHSA-v2mw-x6g2-24jf.