From dc0566dc54d6aada3973eb1a86e6a8f2cc64d3b7 Mon Sep 17 00:00:00 2001
From: Colm O hEigeartaigh <coheigea@apache.org>
Date: Mon, 7 Sep 2026 11:44:26 +0100
Subject: [PATCH] Harden Content-Disposition filename parsing against ReDoS

---
 .../cxf/attachment/ContentDisposition.java    |  3 +-
 .../attachment/ContentDispositionTest.java    | 48 +++++++++++++++++++
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java

diff --git a/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java b/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
index a6ae0f2b0a5..44a2d710270 100644
--- a/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
+++ b/core/src/main/java/org/apache/cxf/attachment/ContentDisposition.java
@@ -32,8 +32,9 @@ public class ContentDisposition {
     private static final Pattern CD_HEADER_PARAMS_PATTERN =
             Pattern.compile(CD_HEADER_PARAMS_EXPRESSION);
 
+    // Keep the alternatives disjoint and prevent backtracking over the encoded value.
     private static final String CD_HEADER_EXT_PARAMS_EXPRESSION =
-            "(?i)(UTF-8|ISO-8859-1)''((?:%[0-9a-f]{2}|\\S)+)";
+            "(?i)(UTF-8|ISO-8859-1)''((?:%[0-9a-f]{2}|[^%\\s])++)";
     private static final Pattern CD_HEADER_EXT_PARAMS_PATTERN =
             Pattern.compile(CD_HEADER_EXT_PARAMS_EXPRESSION);
     private static final Pattern CODEPOINT_ENCODED_VALUE_PATTERN = Pattern.compile("&#[0-9]{4};|\\S");
diff --git a/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java b/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java
new file mode 100644
index 00000000000..45f503dac19
--- /dev/null
+++ b/core/src/test/java/org/apache/cxf/attachment/ContentDispositionTest.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.attachment;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+public class ContentDispositionTest {
+
+    @Test
+    public void testExtendedFilenameIsDecoded() {
+        ContentDisposition cd = new ContentDisposition("attachment;filename*=UTF-8''a%20file.txt");
+        assertEquals("attachment", cd.getType());
+        assertEquals("a file.txt", cd.getFilename());
+    }
+
+    @Test(timeout = 10000)
+    public void testMalformedExtendedFilenameDoesNotOverflow() {
+        StringBuilder value = new StringBuilder("attachment;filename*=UTF-8''");
+        for (int i = 0; i < 2000; i++) {
+            value.append("%41");
+        }
+        value.append(" x");
+
+        ContentDisposition cd = new ContentDisposition(value.toString());
+
+        assertNull(cd.getFilename());
+    }
+}
\ No newline at end of file