CVE-2026-86463

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86463
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86463.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86463
Published
2026-10-09T10:18:42Z
Modified
2026-10-24T10:51:18Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache CXF: FIQL Query Parser Denial of Service
Details

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.

Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Database specific 
{
    "cna_assigner":  "apache",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86463.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "4.2.0"
                        },
                        {
                            "fixed":  "4.2.4"
                        },
                        {
                            "introduced":  "4.0.0"
                        },
                        {
                            "fixed":  "4.1.9"
                        },
                        {
                            "fixed":  "3.6.13"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8999af05d26ef2e63dc4c77a798595e2a53435ad
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
043829b193a6ead389864e636a07ddf6bfa2ca8a
Introduced
04ccbfd709eef8f4af53d6237514fbe9db7ea81f
Fixed
5e324f121104cc76af1b8f3ec0d1a20ef9e98c3b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.6.13"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.1.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.2.0"
                },
                {
                    "fixed":  "4.2.4"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.6.0
cxf-3.6.1
cxf-3.6.10
cxf-3.6.11
cxf-3.6.12
cxf-3.6.2
cxf-3.6.3
cxf-3.6.4
cxf-3.6.5
cxf-3.6.6
cxf-3.6.7
cxf-3.6.8
cxf-3.6.9
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4
cxf-4.1.0
cxf-4.1.1
cxf-4.1.2
cxf-4.1.3
cxf-4.1.4
cxf-4.1.5
cxf-4.1.6
cxf-4.1.7
cxf-4.1.8
cxf-4.2.0
cxf-4.2.1
cxf-4.2.2
cxf-4.2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86463.json"