CVE-2026-78384

A flaw was found in Apache CXF. A remote attacker can trigger a Denial of Service DoS by submitting specially crafted compressed data during token processing. Because the system decompresses incoming data without enforcing a maximum output size limit, a small payload can consume excessive heap...