What is GHSA-rqrh-ghmh-74j5?

GHSA-rqrh-ghmh-74j5 is a security advisory published by GitHub Security Advisories with High severity. Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the ...

Which CVE IDs does GHSA-rqrh-ghmh-74j5 cover?

GHSA-rqrh-ghmh-74j5 covers the following CVE IDs: CVE-2026-57819. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rqrh-ghmh-74j5?

GHSA-rqrh-ghmh-74j5 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-rqrh-ghmh-74j5HighCVSS 7.5

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the ...

Vendor

GitHub Security Advisories

Published

August 6, 2026

Last Modified

August 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-57819 →

📋 Description

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-57819
https://lists.apache.org/thread/2n14mk01bjc3lrsyhzrkwy8h86289mov
http://www.openwall.com/lists/oss-security/2026/08/06/15
https://github.com/advisories/GHSA-rqrh-ghmh-74j5