| CVE-2026-50633 |
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50632 |
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50631 |
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50630 |
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50629 |
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50628 |
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50627 |
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-49875 |
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-50623 |
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing…
|
Not rated
|
Jun 12, 2026 |
| CVE-2026-44417 |
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that…
|
Not rated
|
May 22, 2026 |
| CVE-2026-44618 |
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks
|
Not rated
|
May 22, 2026 |
| CVE-2026-44930 |
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an…
|
Not rated
|
May 22, 2026 |
| CVE-2025-48913 |
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs,…
|
Not rated
|
Aug 8, 2025 |
| CVE-2025-48795 |
Apache CXF stores large stream based messages as temporary files on the local filesystem
|
Not rated
|
Jul 15, 2025 |
| CVE-2025-23184 |
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some…
|
5.9
Medium
|
Jan 21, 2025 |
| CVE-2024-41172 |
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client…
|
Not rated
|
Jul 19, 2024 |
| CVE-2024-32007 |
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an…
|
Not rated
|
Jul 19, 2024 |
| CVE-2024-29736 |
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an…
|
Not rated
|
Jul 19, 2024 |
| CVE-2024-28752 |
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an…
|
Not rated
|
Mar 15, 2024 |
| CVE-2022-46364 |
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before…
|
Not rated
|
Dec 13, 2022 |
| CVE-2022-46363 |
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory…
|
Not rated
|
Dec 13, 2022 |
| CVE-2021-30468 |
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web…
|
Not rated
|
Jun 16, 2021 |
| CVE-2021-22696 |
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters…
|
Not rated
|
Apr 2, 2021 |
| CVE-2020-13954 |
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses
|
Not rated
|
Nov 12, 2020 |
| CVE-2018-8039 |
It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via…
|
Not rated
|
Jul 2, 2018 |