Apache CXF does not impose a default limit on the number of form parameters in a JAX-RS request, allowing an attacker to submit a request with a very large number of form fields. The lack of a limit can consume excessive memory and processing resources, leading to application slowdown or crash and thus a denial of service. The vulnerability is a classic resource exhaustion flaw as identified by CWE-400.

All Apache CXF releases prior to versions 4.2.3, 4.1.8, and 3.6.12 are affected. These versions lack the default 500‑parameter cap introduced in the later releases. Users running older or unpatched CXF deployments should review their version and apply the recommended upgrade if possible.

The vulnerability can be triggered by sending an HTTP request containing a large number of form parameters; no authentication or privileged state is required. The CVSS score of 7.5 signifies a high severity, indicating significant potential impact to availability. Though no EPSS value is available, the absence of a default limit indicates a feasible exploitation path, especially against publicly exposed APIs. Since the issue is not listed in CISA KEV, it has not yet been identified as a widely exploited vulnerability, but the potential for denial of service remains significant for exposed services.