eap8-apache-cxf: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount"...
CVE-2026-57819 is fixed in 3 products on 1 platform, first by RHSA-2026:92059, released August 17, 2026. It is not reported as exploited. Patch Radar priority: High.
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| eap8-apache-cxf · RHEL 10 | 4.1.8-1.redhat_00001.1.el10eap | RHSA-2026:92059 | Aug 17, 2026 |
| ovirt-engine-wildfly · ol 8 | 0:24.0.1-4.el8 | ELSA-2026-500570 | Nov 7, 2026 |
| ovirt-engine-wildfly · ol 9 | 0:24.0.1-4.el9 | ELSA-2026-500571 | Nov 7, 2026 |
| ovirt-engine-wildfly-overlay · ol 8 | 0:24.0.1-4.el8 | ELSA-2026-500570 | Nov 7, 2026 |
| ovirt-engine-wildfly-overlay · ol 9 | 0:24.0.1-4.el9 | ELSA-2026-500571 | Nov 7, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.