Quarkus CXF 3.33.15 LTS release notes
Important dependency upgrades
-
Apache CXF 4.1.8 → 4.1.9 - release notes, changelog, fixed CVEs (see the Apache CXF security advisories for details):
-
CVE-2026-78384 Unbounded DEFLATE decompression can exhaust memory (
org.apache.cxf:cxf-core) -
CVE-2026-97468 Weak cache keys for validated STS tokens can bypass authentication (
org.apache.cxf:cxf-rt-ws-securityandorg.apache.cxf.services.sts:cxf-services-sts-core) -
CVE-2026-97791 Shared validation state in
STSTokenValidatorcan allow untrusted SAML assertions (org.apache.cxf:cxf-rt-ws-security) -
CVE-2026-107937 Repeated or folded attachment headers can bypass size and count limits, exhausting memory (
org.apache.cxf:cxf-core) -
CVE-2026-108039 Missing default XML element and character limits can cause excessive memory and CPU usage (
org.apache.cxf:cxf-core)
-
Breaking changes
Default limits on XML parsing and decompression
Before Quarkus CXF 3.33.15 and 3.40.3, CXF imposed no default limit on the total number of XML elements,
the total number of XML characters, or the output size of CompressionUtils.inflate().
Since Quarkus CXF 3.33.15 and 3.40.3, the defaults are 5,000,000 elements,
268,435,456 XML characters and 10 MiB of decompressed data, respectively.
Applications processing larger inputs may need to adjust these limits.
See CVE-2026-108039
and CVE-2026-78384 for the corresponding CXF system properties.
For native mode, those properties have to be set at build time.