Is CVE-2026-108039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108039 being exploited in the wild.

How severe is CVE-2026-108039?

High severity, with a CVSS score of 7.5, published 9 October 2026.

Which products and versions are affected?

Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4.

How is CVE-2026-108039 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108039?

Check whether you run Apache CXF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108039: Apache CXF StaxUtils XML denial of service

CVE-2026-108039 · Severity: high · CVSS 7.5 · Published 2026-10-09

Apache CXF, a framework for building web services, did not limit the size of XML documents it processed by default. An attacker could send a very large XML request that consumes excessive memory and CPU, causing the service to become unavailable or slow to unacceptable levels. This is a denial of service vulnerability that affects any system relying on CXF to parse untrusted XML input.

Technologies: Apache CXF. Vendors: Apache.

Quick answers

Is CVE-2026-108039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108039 being exploited in the wild.
How severe is CVE-2026-108039?: High severity, with a CVSS score of 7.5, published 9 October 2026.
Which products and versions are affected?: Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4.
Is there a fix for CVE-2026-108039?: Yes: fixed in CXF 3.6.13, 4.1.9, 4.2.4. Until then: Applications processing larger XML documents can configure higher limits using the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters system properties before upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108039 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108039?: Check whether you run Apache CXF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CXF 3.6.13, 4.1.9, 4.2.4

Applications processing larger XML documents can configure higher limits using the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters system properties before upgrading.

Technical details

StaxUtils in Apache CXF lacked default limits on XML element count and document character size, allowing unbounded resource consumption during parsing. The vulnerability affects XML processing in components like SAAJ and WS-Security that build DOM trees from untrusted input. An unauthenticated network attacker can trigger denial of service by submitting malformed or extremely large XML documents without requiring user interaction.

Affected products

Apache CXF before 3.6.13, 4.1.x before 4.1.9, 4.2.x before 4.2.4

Timeline

2026-10-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.