CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments
Attackers can cause denial of service by sending large attachments if the default size limit is not explicitly configured in Apache CXF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54225?
CVE-2026-54225 is a high-severity denial of service vulnerability in Apache Cxf, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.
Weakness: CWE-770
Which versions are affected by CVE-2026-54225?
It affects 1 product.
Products include Apache Cxf.
How do I fix CVE-2026-54225?
No fix has been published for CVE-2026-54225 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54225 being exploited?
There is no known exploitation of CVE-2026-54225 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-h9mr-9vh5-65gw.