CVE-2026-54225

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

• CWE-770

• https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfyMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/08/06/14

Published

Aug 6, 2026

Last Modified

Aug 7, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5422A path traversal vulnerability exists in jupyter-server vers…8.1
• CVE-2026-54220uBB.threads is vulnerable to a Cross-Site Request Forgery (C…8.6
• CVE-2026-54221UBB.threads is vulnerable to Reflected XSS. The application …5.1
• CVE-2026-54222UBB.threads is vulnerable to Blind SQL Injection, allowing a…8.6
• CVE-2026-54223UBB.threads is vulnerable to Path traversal, allowing attack…8.6
• CVE-2026-54224UBB.threads is vulnerable to Denial of Service (DoS). By sen…7.1
• CVE-2026-54226A vulnerability in Apache Kvrocks. This issue affects Apach…6.4
• CVE-2026-54228A time-of-check time-of-use (TOCTOU) race condition was foun…7.8
• CVE-2026-54229A race condition was found in the abrt-dbus D-Bus service's …7
• CVE-2026-5423@neo4j/graphql library versions prior to 7.5.6 fail to verif…8.2
• CVE-2026-54230A symlink following vulnerability was found in the ABRT post…7.8
• CVE-2026-54231A content injection vulnerability was found in the ABRT post…5.5