Apache Cxf (Apache Software Foundation) - vulnerabilities (CVEs)

56 CVEs, 11 in the last 30 days, 2 known versions, newest CVE from 2026-10-09. Vendor: Apache Software Foundation.

CVEs of Apache Cxf

CVE-2026-108039 - CVSS 7.5 (high), 2026-10-09: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could…
CVE-2026-107938 - CVSS 9.1 (critical), 2026-10-09: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate…
CVE-2026-107937 - CVSS 7.5 (high), 2026-10-09: In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters)…
CVE-2026-100227 - CVSS 7.5 (high), 2026-10-09: Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors…
CVE-2026-97791 - CVSS 7.5 (high), 2026-10-09: In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was…
CVE-2026-97468 - CVSS 9.1 (critical), 2026-10-09: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java…
CVE-2026-86463 - CVSS 7.5 (high), 2026-10-09: Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many…
CVE-2026-79650 - CVSS 6.1 (medium), 2026-10-09: Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because…
CVE-2026-78384 - CVSS 7.5 (high), 2026-10-09: CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on…
CVE-2026-73179 - CVSS 8.1 (high), 2026-10-09: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to…
CVE-2026-71575 - CVSS 9.1 (critical), 2026-10-09: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted…
CVE-2026-57818 - CVSS 8.1 (high), 2026-08-06: A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the…
CVE-2026-61466 - CVSS 9.1 (critical), 2026-08-06: In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration…
CVE-2026-63687 - CVSS 9.1 (critical), 2026-08-06: Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive…
CVE-2026-65583 - CVSS 9.1 (critical), 2026-08-06: Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and…
CVE-2026-68079 - CVSS 9.8 (critical), 2026-08-06: In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the…
CVE-2026-68481 - CVSS 7.5 (high), 2026-08-06: In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The…
CVE-2026-65432 - CVSS 7.5 (high), 2026-08-06: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or…
CVE-2026-57817 - CVSS 8.1 (high), 2026-08-06: The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is…
CVE-2026-66909 - CVSS 9.8 (critical), 2026-08-06: Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any…
CVE-2026-64958 - CVSS 7.5 (high), 2026-08-06: An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many…
CVE-2026-57819 - CVSS 7.5 (high), 2026-08-06: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no…
CVE-2026-54225 - CVSS 7.5 (high), 2026-08-06: Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default…
CVE-2026-50632 - CVSS 8.8 (high), 2026-06-12: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can…
CVE-2026-50645 - CVSS 7.5 (high), 2026-06-12: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled…
CVE-2026-50631 - CVSS 7.4 (high), 2026-06-12: A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple…
CVE-2026-50634 - CVSS 6.5 (medium), 2026-06-12: A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted…
CVE-2026-50633 - CVSS 8.1 (high), 2026-06-12: A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to…
CVE-2026-49875 - CVSS 9.8 (critical), 2026-06-12: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations,…
CVE-2026-50628 - CVSS 9.8 (critical), 2026-06-12: A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP…
CVE-2026-50627 - CVSS 9.1 (critical), 2026-06-12: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one…
CVE-2026-50630 - CVSS 6.5 (medium), 2026-06-12: A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is…
CVE-2026-50623 - CVSS 4.8 (medium), 2026-06-12: An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context…
CVE-2026-50629 - CVSS 5.3 (medium), 2026-06-12: The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters.…
CVE-2026-44417 - CVSS 7.5 (high), 2026-05-22: The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code…
CVE-2026-44618 - CVSS 5.3 (medium), 2026-05-22: Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions…
CVE-2026-44930 - CVSS 9.8 (critical), 2026-05-22: An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates…
CVE-2025-48913 - CVSS 9.8 (critical), 2025-08-08: If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution…
CVE-2025-48795 - CVSS 5.6 (medium), 2025-07-15: Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is…
CVE-2025-23184 - CVSS 7.5 (high), 2025-01-21: A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream…
CVE-2024-41172 - CVSS 7.5 (high), 2024-07-19: In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from…
CVE-2024-29736 - CVSS 9.1 (critical), 2024-07-19: A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on…
CVE-2024-32007 - CVSS 7.5 (high), 2024-07-19: An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service…
CVE-2024-28752 - CVSS 9.3 (critical), 2024-03-15: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on…
CVE-2022-46364 - CVSS 9.8 (critical), 2022-12-13: A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to…
CVE-2022-46363 - CVSS 7.5 (high), 2022-12-13: A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The…
CVE-2021-30468 - CVSS 7.5 (high), 2021-06-16: A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread…
CVE-2021-22696 - CVSS 7.5 (high), 2021-04-02: CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework:…
CVE-2020-13954 - CVSS 6.1 (medium), 2020-11-12: By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…
CVE-2018-8039 - CVSS 8.1 (high), 2018-07-02: It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs",…
CVE-2017-12624 - CVSS 5.5 (medium), 2017-11-14: Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that…
CVE-2016-8739 - CVSS 7.5 (high), 2017-08-10: The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera…
CVE-2017-3156 - CVSS 7.5 (high), 2017-08-10: The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison…
CVE-2016-6812 - CVSS 6.1 (medium), 2017-08-10: The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names…
CVE-2017-5653 - CVSS 5.3 (medium), 2017-04-18: JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows…
CVE-2017-5656 - CVSS 7.5 (high), 2017-04-18: Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker…