All vulnerabilities
CVE-2026-86463

Apache CXF: FIQL Query Parser Denial of Service

Apache Software Foundation Apache CXF
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.4Also 4.1.9, 3.6.13CVE List
Published9 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.

Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Text from CVE List

Affected versions 3

  • Apache CXFaffected: 4.2.0 before 4.2.4CVE List
  • Apache CXFaffected: 4.0.0 before 4.1.9CVE List
  • Apache CXFaffected: all versions before 3.6.13CVE List

References 1