Quarkus CXF 3.40.3 LTS release notes
Important dependency upgrades
-
Apache CXF 4.2.3 → 4.2.4 - release notes, changelog, fixed CVEs (see the Apache CXF security advisories for details):
-
CVE-2026-78384 Unbounded DEFLATE decompression can exhaust memory (
org.apache.cxf:cxf-core) -
CVE-2026-97468 Weak cache keys for validated STS tokens can bypass authentication (
org.apache.cxf:cxf-rt-ws-securityandorg.apache.cxf.services.sts:cxf-services-sts-core) -
CVE-2026-97791 Shared validation state in
STSTokenValidatorcan allow untrusted SAML assertions (org.apache.cxf:cxf-rt-ws-security) -
CVE-2026-107937 Repeated or folded attachment headers can bypass size and count limits, exhausting memory (
org.apache.cxf:cxf-core) -
CVE-2026-108039 Missing default XML element and character limits can cause excessive memory and CPU usage (
org.apache.cxf:cxf-core)
-
Documentation improvements
#1449 Document that the whole class hierarchy of a service implementation must be available in Jandex
The new Service classes from other modules guide explains how to index service interfaces and superclasses supplied by dependencies, including other modules of the same project.
Before Quarkus CXF 3.40.3, the build error for a service interface missing from Jandex contained an unresolved documentation attribute. Since Quarkus CXF 3.40.3, the message contains a working link to the Quarkus indexing documentation.
Special thanks to @rolfedh for contributing the guide and error message fix.
SOAP endpoint paths
-
The SOAP and REST endpoints in the same application guide explains how to avoid routing conflicts with Quarkus REST, RESTEasy Classic and reactive routes.
-
The Client endpoint URL defaults guide now accounts for the default
/servicesvalue ofquarkus.cxf.path.
Breaking changes
Default limits on XML parsing and decompression
Before Quarkus CXF 3.40.3 and 3.33.15, CXF imposed no default limit on the total number of XML elements,
the total number of XML characters, or the output size of CompressionUtils.inflate().
Since Quarkus CXF 3.40.3 and 3.33.15, the defaults are 5,000,000 elements,
268,435,456 XML characters and 10 MiB of decompressed data, respectively.
Applications processing larger inputs may need to adjust these limits.
See CVE-2026-108039
and CVE-2026-78384 for the corresponding CXF system properties.
For native mode, those properties have to be set at build time.