{"id":"CVE-2026-86463","revision":"60a4faaaa22b493d9b0430f2cddd85f0","records":[{"revision":"60a4faaaa22b493d9b0430f2cddd85f0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-86463","aliases":[],"title":"Apache CXF: FIQL Query Parser Denial of Service","description":"Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.\n\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","state":0,"publishedAt":"2026-10-09T10:18:42.008+00:00","modifiedAt":"2026-10-15T16:26:53.196+00:00","affected":[{"ecosystem":"https://repo.maven.apache.org/maven2","name":"org.apache.cxf:cxf-rt-rs-extension-search","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"product\": \"Apache CXF\",\n                    \"collectionURL\": \"https://repo.maven.apache.org/maven2\",\n                    \"packageName\": \"org.apache.cxf:cxf-rt-rs-extension-search\",\n                    \"packageURL\": \"pkg:maven/org.apache.cxf/cxf-rt-rs-extension-search\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.2.0\",\n                            \"lessThan\": \"4.2.4\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.1.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.6.13\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://lists.apache.org/thread.html/mv5qfmd27gkbvt3k6by9db5bolrsbgy1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-86463","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-86463","identifiers":["CVE-2026-86463"]},"retained":false,"historicalAffected":[]}],"coverage":[]}