CVE-2025-48913

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@apache.org

Published

2025-08-08

Last modified

2026-02-26

Weaknesses

CWE-20

Affected products

• Cxf (Apache)
• Apache Cxf (Apache Software Foundation)

References

• https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
• http://www.openwall.com/lists/oss-security/2025/08/07/2