VYPR
← All advisories
High severity7.5NVD Advisory· Published Aug 6, 2026· Updated Aug 7, 2026

CVE-2026-54225

CVE-2026-54225

Description

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Cxf2 versions
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <3.6.12
    • (no CPE)range: <4.2.3, <4.1.8, <3.6.12

Patches

Vulnerability mechanics

References

2

News mentions

1