CVE-2026-108039

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

• CWE-776

• https://lists.apache.org/thread.html/ms2gbpof609o0v1bjlzb1rn7fwh61l1jIssue Tracking, Vendor Advisory, Mailing List
• https://www.openwall.com/lists/oss-security/2026/10/09/14Mailing List, Third Party Advisory

Published

Oct 9, 2026

Last Modified

Oct 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1080GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-10800A weakness has been identified in PaddlePaddle FastDeploy up…3.6
• CVE-2026-10801A security vulnerability has been detected in modelscope ms-…3.6
• CVE-2026-108013BigFix Platform uses Mozilla CA certificate bundle (PEM). Ve…6.8
• CVE-2026-10802A vulnerability was detected in keystonejs keystone up to 20…4.3
• CVE-2026-10803A flaw has been found in MLflow up to 3.10.0. This issue aff…3.6
• CVE-2026-10804A vulnerability has been found in Streamlit up to 1.53.0. Im…4.7
• CVE-2026-10805A flaw was found in NetworkManager. This local privilege esc…6.7
• CVE-2026-10806A vulnerability was found in mjperpinosa stumasy. The affect…6.3
• CVE-2026-108062Pre-authentication OIDC discovery and JWKS fetches run synch…6.9
• CVE-2026-108063A flaw was found in libhangul. When parsing Hanja dictionary…5.5
• CVE-2026-108064The WP Encryption WordPress plugin before 7.8.8.2 does not …6.5