https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T23:05:36.151609+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54225 CVE-2026-54225 — Apache CXF: Denial of Service attack via large attachments 2026-10-06T23:05:36.152931+00:00

Affected: Apache Software Foundation Apache CXF

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.