CVE-2026-86463

HighCVSS 7.5/10Last modified Oct 20, 2026

Description

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.

Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	>= 4.2.0, < 4.2.4; >= 4.0.0, < 4.1.9; < 3.6.13

References

https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1Issue Tracking, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/09/8Mailing List, Third Party Advisory

Timeline

Published: Oct 9, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-864649.9In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deplo CVE-2026-864656.5Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-tea CVE-2026-864668.1Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_toke CVE-2026-864678.8Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began i CVE-2026-864686.5Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave s CVE-2026-864695.3A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX tempo CVE-2026-86474.8Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes fu CVE-2026-864719.3An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary CVE-2026-864724.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, CVE-2026-864739.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting CVE-2026-864747.7The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, a CVE-2026-864755.3The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity co