CVE-2026-86463

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

• CWE-400

• https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1Issue Tracking, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/10/09/8Mailing List, Third Party Advisory

Published

Oct 9, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86451Affected versions of MISP allow authenticated users to retri…4.3
• CVE-2026-86452Affected versions of MISP permit unauthenticated or weakly c…7.5
• CVE-2026-8646IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphe…9.1
• CVE-2026-86460Cypher injection vulnerability in the Neo4j persistence laye…9.8
• CVE-2026-86461The FV Flowplayer Video Player plugin for WordPress is vulne…8.8
• CVE-2026-86462Apache Airflow FAB provider: changing a user's password thro…9.1
• CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
• CVE-2026-86465Apache Airflow Akeyless provider: the Akeyless secrets backe…6.5
• CVE-2026-86466Apache Airflow FAB provider: the Authentik OAuth path in the…8.1
• CVE-2026-86467Apache Airflow Amazon provider: the AWS auth manager's SAML …
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8