CVE-2026-54225

CVE-2026-54225 affects Apache CXF. The issue is that prior to CXF 4.2.3, 4.1.8 and 3.6.12 there was no default limit on the maximum attachment size, enabling a potential denial-of-service via large attachments. The default size limit of 50 MB is fixed in CXF 4.2.3, 4.1.8, and 3.6.12. If exploitin...