Threats affecting pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-frontend-jaxrs

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 do not set a default limit on the number of form parameters in JAX-RS messages. This lack of a default limit can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions when processing requests with very large numbers of form parameters. The issue is addressed by introducing a default limit of 500 parameters in the fixed versions.