CVE-2026-54225

Katalog CVE

CVSS 7.5 · High EPSS 0,73%

Kerentanan Allocation of Resources Without Limits or Throttling pada apache cxf. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/08/06/14