Posted by Colm O hEigeartaigh on Oct 09 Severity: low Affected versions: - Apache CXF 4.2.0 before 4.2.4 - Apache CXF 4.0.0 before 4.1.9 - Apache CXF before 3.6.13 Description: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.
CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/116
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline November 5, 2026 Timothy Amerson BLOG 5 min. TL;DR – GAO’s latest report shows why waiting for the compliance…
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve…
A Hybrid Approach for Automated Security Pattern Recovery
arXiv:2611.05823v1 Announce Type: new Abstract: Security-by-design emphasises integrating security into software design and development. Security pattern catalogues…
PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
arXiv:2611.06036v1 Announce Type: new Abstract: Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and…
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
arXiv:2611.06477v1 Announce Type: new Abstract: Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce…
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
Posted by Jan Schaumann on Nov 04 This Debian Security Advisory for CVE-2026-109518 in apt(1) seems worth sharing more widely…