CyberRota Analysis
AI-GeneratedApache CXF is vulnerable due to the absence of a default limit on the number of form parameters in JAX-RS messages, potentially allowing attackers to exploit this configuration and launch denial of service attacks through requests containing excessive parameters. Organizations using affected versions should prioritize upgrading to versions 4.2.3, 4.1.8, or 3.6.12 to mitigate this risk and ensure operational stability.
Original NVD Description
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Related CVEs
Other vulnerabilities affecting the same vendor(s)