The flaw is in CompressionUtils.inflate, which decompresses DEFLATE data without enforcing an output‑size cap. An attacker can craft a modest kilobyte payload that expands to gigabytes when inflated, exhausting heap memory and potentially crashing the Apache CXF application. The unbounded inflation occurs during JWE decryption (when zip=DEF) and during SAML token redirect or POST binding processing, both before trust validation, allowing the attack to bypass authentication checks and target any user of the service.

Apache CXF versions 4.2.4, 4.1.9, and 3.6.13, released by the Apache Software Foundation, are affected. These versions contain the unbounded decompression logic in CompressionUtils.inflate; newer releases contain a configurable maximum inflated‑size cap of 10 MiB.

The vulnerability allows an attacker to send a small crafted payload that expands dramatically on the server, leading to a denial of service by exhausting heap resources. No exploitation notes or CVSS score are present in the available data, and the EPSS score is unavailable, so the exact likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The absence of strong mitigation options other than applying the patch or lowering the max inflated size means organizations should treat this as a high‑risk outcome and address it promptly.