Allocation of Resources Without Limits or Throttling in Apache CXF - CVE-2026-54225

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU144822

Allocation of Resources Without Limits or Throttling in Apache CXF - CVE-2026-54225

Published: August 24, 2026


Vulnerability identifier: #VU144822
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54225
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource control in attachment processing when handling large attachments without a configured maximum attachment size. A remote attacker can send a specially crafted request with a large attachment to cause a denial of service.

Only deployments that do not explicitly configure an attachment size limit are vulnerable.


Affected software

Apache CXF
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
IBM Robotic Process Automation
IBM Tivoli Netcool Configuration Manager
Maximo Application Suite - Monitor Component

How to mitigate CVE-2026-54225

Install security update from vendor's website.

Apache CXF - addressed in versions 3.6.12, 4.1.8, 4.2.3
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
Maximo Application Suite - Monitor Component - addressed in versions 9.0.25, 9.1.15, 9.2.4
IBM Robotic Process Automation - addressed in versions 23.0.20.7, 30.0.4

External References

Related Security Bulletins