{"cve":{"cve_id":"CVE-2026-54225","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00467,"epss_percentile":0.38472,"epss_as_of":"2026-08-26","description":"Apache CXF allows to control the maximum attachment size via the \"attachment-max-size\". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.","published_at":"2026-08-06T10:11:41.498000Z","last_modified_at":"2026-08-07T00:16:31.280000Z","cvss_v3_score":7.5,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_v3_severity":"HIGH","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":true,"ssvc_technical_impact":"partial","cwes":["CWE-770"],"nvd_references":["https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy"],"vuln_status":"Modified","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-08-06T12:40:38.297437Z","updated_at":"2026-08-08T21:17:56.756808Z"},"effective_severity":"HIGH","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"N","value_label":"None"},{"metric":"I","name":"Integrity","value":"N","value_label":"None"},{"metric":"A","name":"Availability","value":"H","value_label":"High"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"apache","vendor_name":"apache","product_slug":"cxf","product_name":"CXF","version_start":null,"version_start_inclusive":null,"version_end":"3.6.12","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*"},{"vendor_slug":"apache-software-foundation","vendor_name":"Apache Software Foundation","product_slug":"apache-cxf","product_name":"Apache CXF","version_start":"4.2.0","version_start_inclusive":true,"version_end":"4.2.3","version_end_inclusive":false,"cpe23_uri":"cve5:apache-software-foundation:apache-cxf:4.2.0:4.2.3"},{"vendor_slug":"apache-software-foundation","vendor_name":"Apache Software Foundation","product_slug":"apache-cxf","product_name":"Apache CXF","version_start":"4.0.0","version_start_inclusive":true,"version_end":"4.1.8","version_end_inclusive":false,"cpe23_uri":"cve5:apache-software-foundation:apache-cxf:4.0.0:4.1.8"},{"vendor_slug":"apache-software-foundation","vendor_name":"Apache Software Foundation","product_slug":"apache-cxf","product_name":"Apache CXF","version_start":"0","version_start_inclusive":true,"version_end":"3.6.12","version_end_inclusive":false,"cpe23_uri":"cve5:apache-software-foundation:apache-cxf:0:3.6.12"}],"exploit_refs":[],"news":[],"references":[{"url":"https://lists.apache.org/thread/h2bjqm6g58z0j6893qzh728kdtk1byfy","source_type":"MAILING_LIST","tags":["mailing-list"]}],"timeline":[{"type":"published","at":"2026-08-06T10:11:41.498000Z","label":"CVE published","source":null},{"type":"cvss_changed","at":"2026-08-06T15:40:38.298186Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-08-06T15:40:38.298186Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-08-06T15:40:38.298186Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"ssvc_changed","at":"2026-08-06T16:41:38.288298Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-06T16:41:38.288298Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-06T16:41:38.288298Z","label":"SSVC decision revised","source":"vulnrichment"}]}