Aller au contenu
en Se connecter
Non notée

CVE-2026-50632 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache…

Description

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache CXF 4.2 4.2.0 → < 4.2.2 4.2.2
Apache CXF 4.0 4.0.0 → < 4.1.7 4.1.7
Apache CXF 3.6 premières → < 3.6.12 3.6.12
Red Hat build of Apache Camel for Spring Boot 4 Versions non publiées
Red Hat Fuse 7 Versions non publiées
Red Hat JBoss Enterprise Application Platform 7 Versions non publiées
Red Hat JBoss Enterprise Application Platform 8 Versions non publiées
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions non publiées
Red Hat Single Sign-On 7 Versions non publiées
Afficher l’autre branche
Produit Versions touchées Corrigé en
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache CXF

Les 56 CVE de Apache CXF →
CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML… Non notée CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the… Non notée CVE-2026-107937 In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured… Non notée CVE-2026-100227 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module Non notée
Suivre cette CVE