CVE-2026-44618

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Score

CVSS 3.1 5.3 Medium

Status

Modified - security@apache.org

Published

2026-05-22

Last modified

2026-05-22

Weaknesses

CWE-611

Affected products

• Cxf (Apache)
• Apache Cxf (Apache Software Foundation)

References

• https://lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7
• http://www.openwall.com/lists/oss-security/2026/05/22/8