CVE-2026-54225 | Apache CXF up to 3.6.11/4.1.7/4.2.2 attachment-max-size resource consumption

A vulnerability was found in Apache CXF up to 3.6.11/4.1.7/4.2.2. It has been declared as problematic. The affected element is an unknown function. Such manipulation of the argument attachment-max-size leads to resource consumption.

This vulnerability is documented as CVE-2026-54225. The attack can be executed remotely. There is not any exploit available.

It is recommended to upgrade the affected component.