Cxf (Apache) - vulnerabilities (CVEs)

80 CVEs, 11 in the last 30 days, 236 known versions, newest CVE from 2026-10-09. Vendor: Apache.

CVEs of Cxf

CVE-2026-108039 - CVSS 7.5 (high), 2026-10-09: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could…
CVE-2026-107938 - CVSS 9.1 (critical), 2026-10-09: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate…
CVE-2026-107937 - CVSS 7.5 (high), 2026-10-09: In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters)…
CVE-2026-100227 - CVSS 7.5 (high), 2026-10-09: Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors…
CVE-2026-97791 - CVSS 7.5 (high), 2026-10-09: In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was…
CVE-2026-97468 - CVSS 9.1 (critical), 2026-10-09: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java…
CVE-2026-86463 - CVSS 7.5 (high), 2026-10-09: Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many…
CVE-2026-79650 - CVSS 6.1 (medium), 2026-10-09: Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because…
CVE-2026-78384 - CVSS 7.5 (high), 2026-10-09: CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on…
CVE-2026-73179 - CVSS 8.1 (high), 2026-10-09: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to…
CVE-2026-71575 - CVSS 9.1 (critical), 2026-10-09: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted…
CVE-2026-57818 - CVSS 8.1 (high), 2026-08-06: A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the…
CVE-2026-61466 - CVSS 9.1 (critical), 2026-08-06: In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration…
CVE-2026-63687 - CVSS 9.1 (critical), 2026-08-06: Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive…
CVE-2026-65583 - CVSS 9.1 (critical), 2026-08-06: Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and…
CVE-2026-68079 - CVSS 9.8 (critical), 2026-08-06: In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the…
CVE-2026-68481 - CVSS 7.5 (high), 2026-08-06: In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The…
CVE-2026-65432 - CVSS 7.5 (high), 2026-08-06: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or…
CVE-2026-57817 - CVSS 8.1 (high), 2026-08-06: The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is…
CVE-2026-66909 - CVSS 9.8 (critical), 2026-08-06: Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any…
CVE-2026-64958 - CVSS 7.5 (high), 2026-08-06: An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many…
CVE-2026-57819 - CVSS 7.5 (high), 2026-08-06: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no…
CVE-2026-54225 - CVSS 7.5 (high), 2026-08-06: Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default…
CVE-2026-50633 - CVSS 8.1 (high), 2026-06-12: A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to…
CVE-2026-50632 - CVSS 8.8 (high), 2026-06-12: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can…
CVE-2026-50645 - CVSS 7.5 (high), 2026-06-12: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled…
CVE-2026-50631 - CVSS 7.4 (high), 2026-06-12: A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple…
CVE-2026-50634 - CVSS 6.5 (medium), 2026-06-12: A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted…
CVE-2026-50627 - CVSS 9.1 (critical), 2026-06-12: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one…
CVE-2026-50630 - CVSS 6.5 (medium), 2026-06-12: A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is…
CVE-2026-50623 - CVSS 4.8 (medium), 2026-06-12: An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context…
CVE-2026-50629 - CVSS 5.3 (medium), 2026-06-12: The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters.…
CVE-2026-49875 - CVSS 9.8 (critical), 2026-06-12: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations,…
CVE-2026-50628 - CVSS 9.8 (critical), 2026-06-12: A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP…
CVE-2026-44417 - CVSS 7.5 (high), 2026-05-22: The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code…
CVE-2026-44618 - CVSS 5.3 (medium), 2026-05-22: Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions…
CVE-2026-44930 - CVSS 9.8 (critical), 2026-05-22: An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates…
CVE-2025-48913 - CVSS 9.8 (critical), 2025-08-08: If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution…
CVE-2025-48795 - CVSS 5.6 (medium), 2025-07-15: Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is…
CVE-2025-23184 - CVSS 7.5 (high), 2025-01-21: A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream…
CVE-2024-41172 - CVSS 7.5 (high), 2024-07-19: In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from…
CVE-2024-32007 - CVSS 7.5 (high), 2024-07-19: An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service…
CVE-2024-29736 - CVSS 9.1 (critical), 2024-07-19: A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on…
CVE-2024-28752 - CVSS 9.3 (critical), 2024-03-15: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on…
CVE-2022-46364 - CVSS 9.8 (critical), 2022-12-13: A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to…
CVE-2022-46363 - CVSS 7.5 (high), 2022-12-13: A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The…
CVE-2021-40690 - CVSS 7.5 (high), 2021-09-19: All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not…
CVE-2021-30468 - CVSS 7.5 (high), 2021-06-16: A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread…
CVE-2021-22696 - CVSS 7.5 (high), 2021-04-02: CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework:…
CVE-2020-13954 - CVSS 6.1 (medium), 2020-11-12: By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…
CVE-2020-1954 - CVSS 5.3 (medium), 2020-04-01: Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘…
CVE-2011-2487 - CVSS 5.9 (medium), 2020-03-11: The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
CVE-2019-12423 - CVSS 7.5 (high), 2020-01-16: Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the…
CVE-2019-17573 - CVSS 6.1 (medium), 2020-01-16: By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…
CVE-2019-12406 - CVSS 6.5 (medium), 2019-11-06: Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a…
CVE-2019-12419 - CVSS 9.8 (critical), 2019-11-06: Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability…
CVE-2018-8039 - CVSS 8.1 (high), 2018-07-02: It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs",…
CVE-2017-12624 - CVSS 5.5 (medium), 2017-11-14: Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that…
CVE-2016-8739 - CVSS 7.5 (high), 2017-08-10: The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera…
CVE-2017-3156 - CVSS 7.5 (high), 2017-08-10: The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison…
CVE-2016-6812 - CVSS 6.1 (medium), 2017-08-10: The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names…
CVE-2012-0803 - CVSS 9.8 (critical), 2017-08-08: The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a…
CVE-2017-5656 - CVSS 7.5 (high), 2017-04-18: Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker…
CVE-2017-5653 - CVSS 5.3 (medium), 2017-04-18: JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows…
CVE-2015-5253 - CVSS 4 (medium), 2015-11-18: The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via…
CVE-2014-3623 - CVSS 5 (medium), 2014-10-30: Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not…
CVE-2014-3584 - CVSS 5 (medium), 2014-10-30: The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite…
CVE-2014-0034 - CVSS 4.3 (medium), 2014-07-07: The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows…
CVE-2014-0035 - CVSS 4.3 (medium), 2014-07-07: The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an…
CVE-2014-0110 - CVSS 4.3 (medium), 2014-05-08: Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
CVE-2014-0109 - CVSS 4.3 (medium), 2014-05-08: Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the…
CVE-2013-2160 - CVSS 5 (medium), 2013-08-19: The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service…
CVE-2012-5575 - CVSS 6.4 (medium), 2013-08-19: Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the…
CVE-2013-0239 - CVSS 5 (medium), 2013-03-12: Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to…
CVE-2012-5633 - CVSS 5.8 (medium), 2013-03-12: The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security…
CVE-2012-2378 - CVSS 4.3 (medium), 2013-01-05: Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1…
CVE-2012-2379 - CVSS 10 (critical), 2013-01-03: Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does…
CVE-2012-5786 - CVSS 5.8 (medium), 2012-11-04: The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the…
CVE-2012-3451 - CVSS 4.3 (medium), 2012-09-24: Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header…
CVE-2010-2076 - CVSS 9.8 (critical), 2010-08-19: Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI,…