This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch camel-karaf-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel-karaf.git
The following commit(s) were added to refs/heads/camel-karaf-4.18.x by this
push:
new 9cf398b21 fix(#712): upgrade Apache CXF to 4.1.7 (CVE-2026-44417)
(#723)
9cf398b21 is described below
commit 9cf398b21d492e2e25bb6202e4599070834a071e
Author: JB Onofré <[email protected]>
AuthorDate: Wed Aug 26 08:08:38 2026 +0200
fix(#712): upgrade Apache CXF to 4.1.7 (CVE-2026-44417) (#723)
Bump the bundled Apache CXF from 4.1.5 to 4.1.7 to remediate
CVE-2026-44417 (incomplete fix of CVE-2025-48913, remote code
execution via JMS configuration), which is fixed upstream in CXF
4.1.6 / 4.2.1 / 3.6.11. 4.1.7 is the latest 4.1.x patch and stays
within the existing OSGi import range [4.1,4.2).
The cxf-codegen-plugin version is moved in lockstep. The
camel-cxf-all bundle shades all org.apache.cxf:* artifacts via
${cxf-version}, so the rebuilt bundle embeds and re-exports CXF
4.1.7.
---
pom.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index d608d2404..2d56fd006 100644
--- a/pom.xml
+++ b/pom.xml
@@ -166,8 +166,8 @@
<consul-client-version>1.9.2</consul-client-version>
<couchbase-client-version>3.11.0</couchbase-client-version>
<curator-version>5.9.0</curator-version>
- <cxf-version>4.1.5</cxf-version>
- <cxf-codegen-plugin-version>4.1.5</cxf-codegen-plugin-version>
+ <cxf-version>4.1.7</cxf-version>
+ <cxf-codegen-plugin-version>4.1.7</cxf-codegen-plugin-version>
<cxf-xjc-plugin-version>4.1.2</cxf-xjc-plugin-version>
<cxf-xjc-utils-version>4.1.2</cxf-xjc-utils-version>
<daffodil-version>3.10.0</daffodil-version>
