By default, StaxUtils places no limit on the number or total characters of elements in an XML document. When Apache CXF parses large inputs—such as when building a DOM for SAAJ or WS‑Security—a very large request can consume excessive memory and CPU resources. This uncontrolled resource consumption can cripple a service and cause a denial of service. The underlying weakness is unbounded resource consumption (CWE‑770).

The vulnerability affects Apache CXF releases prior to 4.2.4, 4.1.9, and 3.6.13. All deployments that use the default StaxUtils configuration are exposed because the limits are only 100× the default maximum child elements (5,000,000) and a 256‑megabyte character cap. The affected component is the XML parsing layer used by CXF applications.

The EPSS score is not available and the vulnerability is not listed in CISA KEV. The CVSS score of 7.5 indicates a high severity for this denial‑of‑service flaw. An adversary can exploit the flaw by sending an oversized XML payload to a CXF‑enabled service over the network. No authentication or code execution is required; the attack is performed with standard HTTP requests. The resulting high CPU and memory consumption may crash the service or deny legitimate traffic. Because the flaw is a DoS and not an arbitrary code execution, the risk level is high but the exploitation vector is straightforward.