# CVE-2026-86463: Apache CXF FIQL query parser ReDoS in operator search

Source: https://junglewise.ai/threats/cve-2026-86463-apache-cxf-s-fiql-query-parser-has-a-vulnerability-in-how-it  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-86463 · Severity: high · CVSS 7.5 · Published 2026-10-09

Apache CXF is a web services framework that processes FIQL query expressions. A vulnerability in its query parser causes excessive CPU consumption when processing long inputs without operators, allowing attackers to craft requests that slow down or stop the server from handling legitimate traffic.

Technologies: [Apache CXF](https://junglewise.ai/threats/technologies/apache-cxf). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-86463 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86463 being exploited in the wild.

**How severe is CVE-2026-86463?** High severity, with a CVSS score of 7.5, published 9 October 2026.

**Which products and versions are affected?** Apache CXF below 3.6.13, 4.1.9, 4.2.4.

**Is there a fix for CVE-2026-86463?** Yes: fixed in CXF 3.6.13, 4.1.9, 4.2.4. Until then: Limit the size of incoming FIQL query expressions to 4 KiB or less to prevent excessive parser resource consumption. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86463 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86463?** Check whether you run Apache CXF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CXF 3.6.13, 4.1.9, 4.2.4

Limit the size of incoming FIQL query expressions to 4 KiB or less to prevent excessive parser resource consumption.

## Technical details

The FIQL query parser uses a search pattern that exhibits catastrophic backtracking (ReDoS) when encountering long strings without operators, causing the parser to consume excessive CPU resources. The vulnerable component is the query expression parser; exploitation requires sending a crafted FIQL query over the network. A fix limits FIQL expressions to 4 KiB by default to prevent extremely long inputs.

## Affected products

- Apache CXF below 3.6.13, 4.1.9, 4.2.4

## Timeline

- 2026-10-09: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1](https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1)

## Related threats

- [Apache CXF hash collision bypass in STS token validation](https://junglewise.ai/threats/cve-2026-97468-apache-cxf-s-ststokenvalidator-and-security-token-service-sts)
- [Apache CXF OIDC relying-party open redirect after authentication](https://junglewise.ai/threats/cve-2026-79650-apache-cxf-s-oidc-relying-party-component-could-redirect-users-to)
- [Apache CXF CompressionUtils.inflate() zip bomb](https://junglewise.ai/threats/cve-2026-78384-compressionutils-inflate-decompressed-attacker-controlled-deflate)
- [Apache CXF race condition in OAuth2 authorization code grant](https://junglewise.ai/threats/cve-2026-73179-improper-enforcement-of-single-use-authorization-code-semantics)
- [Apache CXF StaxUtils XML denial of service](https://junglewise.ai/threats/cve-2026-108039-by-default-staxutils-placed-no-limit-on-the-total-number-of)