CVE-2026-86463Apache Cxf Uncontrolled Resource Consumption
NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vulnerability Summary
Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HAttack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Affected & Patched Versions
- Apache Cxf < 3.6.13
- Apache Cxf >= 4.0.0 and < 4.1.9
- Apache Cxf >= 4.2.0 and < 4.2.4
- Apache Cxf 3.6.13
- Apache Cxf 4.1.9
- Apache Cxf 4.2.4
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run Apache Cxf and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Oct 9, 2026Published
- Oct 20, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Apache Cxf CVEsYou are reading CVE-2026-86463. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsMore Apache Cxf CVEs
External References
Data last checked: Nov 13, 2026 21:28 UTC