CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-09 · updated 2026-10-20
Weakness: CWE-400

Description

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected products

Apache Software Foundation Apache CXF: before 3.6.13; from 4.0.0 before 4.1.9; from 4.2.0 before 4.2.4 — fixed in 3.6.13, 4.1.9, 4.2.4

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.6.13, 4.1.9, 4.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-86463 or the next vulnerability affects your stack