| CVE-2026-108039 |
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-107938 |
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-107937 |
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-100227 |
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-97791 |
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-97468 |
Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-86463 |
Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-79650 |
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-78384 |
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-73179 |
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-71575 |
The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a…
|
Not rated
|
Oct 9, 2026 |
| CVE-2026-57818 |
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-61466 |
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope`…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-63687 |
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-65583 |
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-68079 |
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-68481 |
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-65432 |
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-57817 |
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-66909 |
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization,…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-64958 |
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-57819 |
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount"…
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-54225 |
Apache CXF allows to control the maximum attachment size via the "attachment-max-size"
|
Not rated
|
Aug 6, 2026 |
| CVE-2026-50645 |
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50634 |
A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was…
|
Not rated
|
Jun 12, 2026 |