This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-karaf.git
The following commit(s) were added to refs/heads/main by this push:
new 8e6202618 fix(#712): upgrade Apache CXF to 4.1.7 (CVE-2026-44417)
(#717)
8e6202618 is described below
commit 8e62026187db7283a07e65af3062ecfb75560523
Author: JB Onofré <[email protected]>
AuthorDate: Wed Aug 26 08:08:15 2026 +0200
fix(#712): upgrade Apache CXF to 4.1.7 (CVE-2026-44417) (#717)
Bump the bundled Apache CXF from 4.1.5 to 4.1.7 to remediate
CVE-2026-44417 (incomplete fix of CVE-2025-48913, remote code
execution via JMS configuration), which is fixed upstream in CXF
4.1.6 / 4.2.1 / 3.6.11. 4.1.7 is the latest 4.1.x patch and stays
within the existing OSGi import range [4.1,4.2).
The cxf-codegen-plugin version is moved in lockstep. The
camel-cxf-all bundle shades all org.apache.cxf:* artifacts via
${cxf-version}, so the rebuilt bundle embeds and re-exports CXF
4.1.7.
---
pom.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index d736beb4f..dea9fb7f8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -166,8 +166,8 @@
<consul-client-version>1.9.2</consul-client-version>
<couchbase-client-version>3.11.0</couchbase-client-version>
<curator-version>5.9.0</curator-version>
- <cxf-version>4.1.5</cxf-version>
- <cxf-codegen-plugin-version>4.1.5</cxf-codegen-plugin-version>
+ <cxf-version>4.1.7</cxf-version>
+ <cxf-codegen-plugin-version>4.1.7</cxf-codegen-plugin-version>
<cxf-xjc-plugin-version>4.1.2</cxf-xjc-plugin-version>
<cxf-xjc-utils-version>4.1.2</cxf-xjc-utils-version>
<daffodil-version>3.10.0</daffodil-version>
