Description
Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.

Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Published: 2026-10-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

An attacker can exploit an issue in Apache CXF's FIQL query parser that causes the search for operators on a long string without an operator to become stuck, resulting in excessive CPU consumption and service degradation. This flaw is a form of resource exhaustion identified by CWE-399 and can be leveraged to deny service without authentication or local privileges.

Affected Systems

The vulnerability affects Apache Software Foundation's Apache CXF implementation. All releases prior to 4.2.4, prior to 4.1.9, or prior to 3.6.13 are impacted. Users running those older versions should upgrade to the patched releases mentioned above.

Risk and Exploitability

No CVSS or EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely by sending a crafted FIQL query over the network, causing the server to consume high CPU resources and effectively perform a denial‑of‑service attack. No special credentials or local access are required; a single malicious request suffices.

Generated by OpenCVE AI on October 9, 2026 at 11:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache CXF to a patched release (4.2.4, 4.1.9, or 3.6.13 or newer) to enforce the 4 KiB FIQL expression limit.
  • If custom configurations are in use, set the FIQL expression size cap to 4 KiB in the XML or properties files to ensure the limit is enforced.
  • Deploy rate‑limiting or circuit‑breaker policies around the services that accept FIQL queries to protect against accidental or malicious overload.

Generated by OpenCVE AI on October 9, 2026 at 11:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References

Fri, 09 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399

Fri, 09 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache cxf
Vendors & Products Apache
Apache cxf

Fri, 09 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Title Apache CXF: FIQL Query Parser Denial of Service
References

Subscriptions

Apache Cxf
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-15T16:26:53.196Z

Reserved: 2026-09-07T14:23:09.392Z

Link: CVE-2026-86463

cve-icon Vulnrichment

Updated: 2026-10-09T11:08:01.524Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-09T11:17:03.163

Modified: 2026-10-20T12:41:49.507

Link: CVE-2026-86463

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T12:00:07Z

Weaknesses