{"id":"CVE-2026-86463","published":"2026-10-09T11:17:03.163","lastModified":"2026-10-15T17:17:29.397","description":"Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.\n\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/8","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache CXF's FIQL query parser has a CPU exhaustion vulnerability where long strings without operators cause excessive processing time, allowing attackers to consume server resources and potentially slow down or stop other requests.","exploitability":"Exploitation is relatively straightforward as attackers can craft malicious queries that trigger the parser's inefficient search pattern, requiring only access to the affected service's query endpoint with no additional preconditions.","blast_radius":"The impact could be significant in environments where CXF services handle many concurrent requests, potentially causing denial of service for other legitimate users and degrading overall system performance.","remediation":"Upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13 which contain the fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","web","cpu-exhaustion","query-parser"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:02:20.957Z"}}