Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-54225 Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on… https://www.cve.org/CVERecord?id=CVE-2026-54225
Post summary
Announces CVE-2026-54225 in Apache CXF, describing how the maximum attachment size is configurable without defaults in older releases, with a link to the official CVE record.
🚨*CVE* CVE-2026-54225 Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on… https://www.cve.org/CVERecord?id=CVE-2026-54225 ----- Traducción: CVE-2026-54225 Apa… http://infoflow.cloud`
Post summary
The post announces CVE-2026-54225 for Apache CXF, highlighting the lack of a default maximum attachment size and directing readers to the official CVE record for more details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cxf | - | - | - |