CVE-2026-54225 is a resource allocation vulnerability in Apache CXF where the maximum attachment size was not limited by default in versions before 4.2.3, 4.1.8, and 3.6.12. This lack of default throttling can allow an attacker to cause a denial of service by sending excessively large attachments. The vulnerability is identified as CWE-770 (Allocation of Resources Without Limits or Throttling). The fix introduces a default attachment size limit of 50MB to mitigate this risk.

The vulnerability can be exploited to cause denial of service by exhausting resources through large attachments, impacting availability. There is no impact on confidentiality or integrity as per the CVSS vector. The CVSS score is 7.5 (high severity), reflecting the potential for service disruption without requiring privileges or user interaction.

Users should upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12 or later, which implement a default maximum attachment size limit of 50MB. Until upgraded, users should manually configure the "attachment-max-size" property to limit attachment sizes and prevent resource exhaustion. Patch status is not explicitly stated but the fixed versions are identified, so upgrading to these versions is the recommended remediation.