svn commit: r1093264 - in websites/production/cxf/content: . cache

[buildbot]

Author: buildbot
Date: Fri Jun 12 07:43:05 2026
New Revision: 1093264

Log:
Production update by buildbot for cxf

Modified:
   websites/production/cxf/content/cache/main.pageCache
   websites/production/cxf/content/security-advisories.html

Modified: websites/production/cxf/content/cache/main.pageCache
==============================================================================
Binary file (source and/or target). No diff available.

Modified: websites/production/cxf/content/security-advisories.html
==============================================================================
--- websites/production/cxf/content/security-advisories.html    Fri Jun 12 
07:30:36 2026        (r1093263)
+++ websites/production/cxf/content/security-advisories.html    Fri Jun 12 
07:43:05 2026        (r1093264)
@@ -99,7 +99,7 @@ Apache CXF -- Security Advisories
          <td height="100%">
            <!-- Content -->
            <div class="wiki-content">
-<div id="ConfluenceContent"><p><span style="color: rgb(36,41,47);">For 
information on how to report a new security problem please 
see<span>&#160;</span></span><a shape="rect" class="external-link" 
href="https://www.apache.org/security/"; style="text-decoration: 
none;">here</a><span style="color: 
rgb(36,41,47);">.<span>&#160;</span></span></p><h3 
id="SecurityAdvisories-2026">2026</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2026-44417.txt?version=1&amp;modificationDate=1779445819000&amp;api=v2"
 data-linked-resource-id="429064531" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-44417.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-44417</a>: Apache 
CXF:Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to 
RCE)</li><li><a shape="rect" href="security-advi
 
sories.data/CVE-2026-44618.txt?version=1&amp;modificationDate=1779445877000&amp;api=v2"
 data-linked-resource-id="429064532" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-44618.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-44618</a>: Apache CXF: XXE 
vulnerability in WS-Transfer functionality</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-44930.txt?version=1&amp;modificationDate=1779445722000&amp;api=v2"
 data-linked-resource-id="429064529" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-44930.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-44930</a>: Apache CXF: 
LDAP Injectio
 n vulnerability in XKMS LDAP Repository</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-49875.txt?version=1&amp;modificationDate=1781192084000&amp;api=v2"
 data-linked-resource-id="430408836" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-49875.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-49875</a>: Apache CXF: XML 
External Entity (XXE) Injection in W3CMultiSchemaFactory and 
EndpointReferenceUtils&#160;</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50623.txt?version=1&amp;modificationDate=1781192231000&amp;api=v2"
 data-linked-resource-id="430408838" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50623.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" data
 -linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50623</a>: Apache CXF: 
Authentication Bypass in OAuth2 TokenIntrospectionService</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2026-50627.txt?version=1&amp;modificationDate=1781192281000&amp;api=v2"
 data-linked-resource-id="430408839" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50627.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50627</a>: Apache CXF: 
OAuth2: Missing JWT Audience and Issuer Validation in Access Token 
Validator</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50628.txt?version=1&amp;modificationDate=1781192316000&amp;api=v2"
 data-linked-resource-id="430408840" data-linked-resource-version="1" 
data-linked-resource-type="attachment" data-linked-reso
 urce-default-alias="CVE-2026-50628.txt" data-nice-type="Text File" 
data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50628</a>: Apache CXF: 
OAuth2: Inverted IP Binding Check Defeats Security Control</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2026-50629.txt?version=1&amp;modificationDate=1781192369000&amp;api=v2"
 data-linked-resource-id="430408842" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50629.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50629</a>: Apache CXF: 
OAuth2: Log Injection via Unsanitized Client Identifier</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50630.txt?version=1&amp;modificationDate=1781192413000&amp;api=v2"
 data-linked-resource-id="4
 30408843" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50630.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50630</a>: Apache CXF: 
OAuth2: HTTP Response Splitting via WWW-Authenticate Realm 
Injection&#160;</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50631.txt?version=1&amp;modificationDate=1781192445000&amp;api=v2"
 data-linked-resource-id="430408844" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50631.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50631</a>: Apache CXF: 
OAuth2: TOCTOU Race Condition in Refresh Token Processing</li><li><a 
shape="rect" href="security-ad
 
visories.data/CVE-2026-50632.txt?version=2&amp;modificationDate=1781197304000&amp;api=v2"
 data-linked-resource-id="430408845" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50632.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50632</a>: Apache CXF: 
JNDI Injection Vulnerability in JMSConfigFactory</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50633.txt?version=1&amp;modificationDate=1781192513000&amp;api=v2"
 data-linked-resource-id="430408847" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50633.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50633</a>: Apache CXF: 
JNDI Inje
 ction vulnerability in DispatchMDBMessageListenerImpl</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50633.txt?version=1&amp;modificationDate=1781192513000&amp;api=v2"
 data-linked-resource-id="430408847" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50633.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50634</a>: Apache CXF: WS 
JSON request filter trusts metadata from an unvalidated first signature 
entry</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50645.txt?version=3&amp;modificationDate=1781197687000&amp;api=v2"
 data-linked-resource-id="430408849" data-linked-resource-version="3" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50645.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" dat
 a-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2026-50645</a>: Apache CXF: No 
restriction on attachment headers per message</li></ul><h3 
id="SecurityAdvisories-2025">2025</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2025-23184.txt?version=2&amp;modificationDate=1737381863000&amp;api=v2"
 data-linked-resource-id="340036025" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2025-23184.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2025-23184</a>: Apache CXF: 
Denial of Service vulnerability with temporary files&#160;</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2025-48795.txt?version=1&amp;modificationDate=1752578416000&amp;api=v2"
 data-linked-resource-id="373886120" data-linked-resource-version="1" 
data-linked-resource-type="att
 achment" data-linked-resource-default-alias="CVE-2025-48795.txt" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2025-48795</a>: Apache CXF: 
Denial of Service and sensitive data exposure in logs&#160;</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2025-48913.txt?version=1&amp;modificationDate=1754576095000&amp;api=v2"
 data-linked-resource-id="373887565" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2025-48913.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2025-48913</a>: Apache CXF: 
Untrusted JMS configuration can lead to RCE&#160;</li></ul><h3 
id="SecurityAdvisories-2024">2024</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2024-28752.txt?version=2&am
 p;modificationDate=1710431346000&amp;api=v2" 
data-linked-resource-id="296290905" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-28752.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2024-28752</a>: Apache CXF SSRF 
Vulnerability using the Aegis databinding&#160;</li><li><a shape="rect" 
href="security-advisories.data/CVE-2024-29736.txt?version=1&amp;modificationDate=1721314668000&amp;api=v2"
 data-linked-resource-id="315493016" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-29736.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2024-29736</a>: SSRF 
vulnerability via WADL stylesheet parameter</li><li><a sha
 pe="rect" 
href="security-advisories.data/CVE-2024-32007.txt?version=1&amp;modificationDate=1721314761000&amp;api=v2"
 data-linked-resource-id="315493017" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-32007.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2024-32007</a>: Apache CXF 
Denial of Service vulnerability in JOSE</li><li><a shape="rect" 
href="security-advisories.data/CVE-2024-41172.txt?version=1&amp;modificationDate=1721314821000&amp;api=v2"
 data-linked-resource-id="315493018" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-41172.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2024-41172</a>: Unre
 stricted memory consumption in CXF HTTP clients</li></ul><h3 
id="SecurityAdvisories-2022">2022</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2022-46363.txt?version=1&amp;modificationDate=1670942001000&amp;api=v2"
 data-linked-resource-id="235836918" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2022-46363.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2022-46363</a>: Apache CXF 
directory listing / code exfiltration</li><li><a shape="rect" 
href="security-advisories.data/CVE-2022-46364.txt?version=1&amp;modificationDate=1670944473000&amp;api=v2"
 data-linked-resource-id="235836926" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2022-46364.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" da
 ta-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2022-46364</a>: Apache CXF SSRF 
Vulnerability</li></ul><h3 id="SecurityAdvisories-2021">2021</h3><ul><li><a 
shape="rect" 
href="security-advisories.data/CVE-2021-30468.txt.asc?version=1&amp;modificationDate=1623835370000&amp;api=v2"
 data-linked-resource-id="181310680" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2021-30468.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2021-30468</a>: Apache CXF 
Denial of service vulnerability in parsing JSON via 
JsonMapObjectReaderWriter</li><li><a shape="rect" 
href="security-advisories.data/CVE-2021-22696.txt.asc?version=1&amp;modificationDate=1617355743000&amp;api=v2"
 data-linked-resource-id="177049091" data-linked-resource-version="1" 
data-linked-resource-type="att
 achment" data-linked-resource-default-alias="CVE-2021-22696.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2021-22696</a>: OAuth 2 
authorization service vulnerable to DDos attacks</li></ul><h3 
id="SecurityAdvisories-2020">2020</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2020-13954.txt.asc?version=1&amp;modificationDate=1605183671000&amp;api=v2"
 data-linked-resource-id="165225095" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2020-13954.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2020-13954</a>: Apache CXF 
Reflected XSS in the services listing page via the styleSheetPath</li><li><a 
shape="rect" href="security-advisories.data/CVE-2020-1954.txt.a
 sc?version=1&amp;modificationDate=1585730169000&amp;api=v2" 
data-linked-resource-id="148645097" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2020-1954.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2020-1954</a>: Apache CXF JMX 
Integration is vulnerable to a MITM attack</li></ul><h3 
id="SecurityAdvisories-2019">2019</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2019-17573.txt.asc?version=2&amp;modificationDate=1584610519000&amp;api=v2"
 data-linked-resource-id="145722246" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-17573.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2019-1757
 3</a>: Apache CXF Reflected XSS in the services listing page</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2019-12423.txt.asc?version=1&amp;modificationDate=1579178393000&amp;api=v2"
 data-linked-resource-id="145722244" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-12423.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2019-12423</a>: Apache CXF 
OpenId Connect JWK Keys service returns private/secret credentials if 
configured with a jwk keystore</li><li><a shape="rect" 
href="security-advisories.data/CVE-2019-12419.txt.asc?version=2&amp;modificationDate=1572961201000&amp;api=v2"
 data-linked-resource-id="135859612" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-12419.txt.asc" 
data-nice-type="Text File" data-lin
 ked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2019-12419</a>: Apache CXF 
OpenId Connect token service does not properly validate the clientId</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2019-12406.txt.asc?version=1&amp;modificationDate=1572957147000&amp;api=v2"
 data-linked-resource-id="135859607" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-12406.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2019-12406</a>: Apache CXF does 
not restrict the number of message attachments</li></ul><h3 
id="SecurityAdvisories-2018">2018</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2018-8039.txt.asc?version=1&amp;modificationDate=1530184663000&amp;api=v2"
 data-linked-resource-id="87296645" 
 data-linked-resource-version="1" data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2018-8039.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2018-8039</a>: Apache CXF TLS 
hostname verification does not work correctly with com.sun.net.ssl.</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2018-8038.txt.asc?version=1&amp;modificationDate=1530712328000&amp;api=v2"
 data-linked-resource-id="87297524" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2018-8038.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2018-8038</a>: Apache CXF Fediz 
is vulnerable to DTD based XML attacks</li></ul><h3 
id="SecurityAdvisories-2017">2017</h3><ul><li><a s
 hape="rect" 
href="security-advisories.data/CVE-2017-12631.txt.asc?version=1&amp;modificationDate=1512037276000&amp;api=v2"
 data-linked-resource-id="74688816" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-12631.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2017-12631</a>: CSRF 
vulnerabilities in the Apache CXF Fediz Spring plugins.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-12624.txt.asc?version=1&amp;modificationDate=1510661632000&amp;api=v2"
 data-linked-resource-id="74687100" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-12624.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63
 ">CVE-2017-12624</a>: Apache CXF web services that process attachments are 
vulnerable to Denial of Service (DoS) attacks.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-7662.txt.asc?version=1&amp;modificationDate=1494949377000&amp;api=v2"
 data-linked-resource-id="70255583" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-7662.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2017-7662</a>: The Apache CXF 
Fediz OIDC Client Registration Service is vulnerable to CSRF 
attacks.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-7661.txt.asc?version=1&amp;modificationDate=1494949364000&amp;api=v2"
 data-linked-resource-id="70255582" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-7661.txt.asc" data-nic
 e-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2017-7661</a>: The Apache CXF 
Fediz Jetty and Spring plugins are vulnerable to CSRF attacks.</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2017-5656.txt.asc?version=1&amp;modificationDate=1492515113000&amp;api=v2"
 data-linked-resource-id="69406543" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-5656.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2017-5656</a>: Apache CXF's 
STSClient uses a flawed way of caching tokens that are associated with 
delegation tokens.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-5653.txt.asc?version=1&amp;modificationDate=1492515074000&amp;api=v2"
 data-linked-resource-id="6
 9406542" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-5653.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2017-5653</a>: Apache CXF 
JAX-RS XML Security streaming clients do not validate that the service response 
was signed or encrypted.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-3156.txt.asc?version=1&amp;modificationDate=1487590374000&amp;api=v2"
 data-linked-resource-id="68715428" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-3156.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2017-3156</a>: Apache CXF 
OAuth2 Hawk and JOSE MAC Validation code is vulnerable to the timi
 ng attacks</li></ul><h3 id="SecurityAdvisories-2016">2016</h3><ul><li><a 
shape="rect" 
href="security-advisories.data/CVE-2016-8739.txt.asc?version=1&amp;modificationDate=1482164360000&amp;api=v2"
 data-linked-resource-id="67635454" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2016-8739.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2016-8739</a>: Atom entity 
provider of Apache CXF JAX-RS is vulnerable to XXE</li><li><a shape="rect" 
href="security-advisories.data/CVE-2016-6812.txt.asc?version=1&amp;modificationDate=1482164360000&amp;api=v2"
 data-linked-resource-id="67635455" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2016-6812.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" data-linked-reso
 urce-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2016-6812</a>: XSS risk in 
Apache CXF FormattedServiceListWriter when a request URL contains matrix 
parameters</li><li><a shape="rect" 
href="security-advisories.data/CVE-2016-4464.txt.asc?version=1&amp;modificationDate=1473350153000&amp;api=v2"
 data-linked-resource-id="65869472" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2016-4464.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2016-4464</a>: Apache CXF Fediz 
application plugins do not match the SAML AudienceRestriction values against 
the list of configured audience URIs</li></ul><h3 
id="SecurityAdvisories-2015">2015</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2015-5253.txt.asc?version=1&amp;modificationDate=1447433340000&amp;api=v2"
 data-linked
 -resource-id="61328642" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2015-5253.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2015-5253</a>: Apache CXF SAML 
SSO processing is vulnerable to a wrapping attack</li><li><a shape="rect" 
href="security-advisories.data/CVE-2015-5175.txt.asc?version=1&amp;modificationDate=1440598018000&amp;api=v2"
 data-linked-resource-id="61316328" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2015-5175.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2015-5175</a>: Apache CXF Fediz 
application plugins are vulnerable to Denial of Service (DoS) 
attacks</li></ul><h3 id="Security
 Advisories-2014">2014</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3577.txt.asc?version=1&amp;modificationDate=1419245371000&amp;api=v2"
 data-linked-resource-id="51183657" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-3577.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-3577</a>: Apache CXF SSL 
hostname verification bypass</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3566.txt.asc?version=1&amp;modificationDate=1418740474000&amp;api=v2"
 data-linked-resource-id="50561078" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-3566.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" data-linked-resource-conta
 iner-version="63">Note on CVE-2014-3566</a>: SSL 3.0 support in Apache CXF, 
aka the "POODLE" attack.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3623.txt.asc?version=1&amp;modificationDate=1414169368000&amp;api=v2"
 data-linked-resource-id="47743195" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-3623.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-3623</a>: Apache CXF does 
not properly enforce the security semantics of SAML SubjectConfirmation methods 
when used with the TransportBinding</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3584.txt.asc?version=1&amp;modificationDate=1414169326000&amp;api=v2"
 data-linked-resource-id="47743194" data-linked-resource-version="1" 
data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2
 014-3584.txt.asc" data-nice-type="Text File" 
data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-3584</a>: Apache CXF 
JAX-RS SAML handling is vulnerable to a Denial of Service (DoS) 
attack</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-0109.txt.asc?version=1&amp;modificationDate=1398873370000&amp;api=v2"
 data-linked-resource-id="40895138" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0109.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-0109</a>: HTML content 
posted to SOAP endpoint could cause OOM errors</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-0110.txt.asc?version=1&amp;modificationDate=1398873378000&amp;api=v2"
 data-linked-resource-id="40895139" data
 -linked-resource-version="1" data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0110.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-0110</a>: Large invalid 
content could cause temporary space to fill</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-0034.txt.asc?version=1&amp;modificationDate=1398873385000&amp;api=v2"
 data-linked-resource-id="40895140" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0034.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-0034</a>: The 
SecurityTokenService accepts certain invalid SAML Tokens as valid</li><li><a 
shape="rect" href="security-advisories.data/CVE-2014-0035.txt.asc?v
 ersion=1&amp;modificationDate=1398873391000&amp;api=v2" 
data-linked-resource-id="40895141" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0035.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="63">CVE-2014-0035</a>: UsernameTokens 
are sent in plaintext with a Symmetric EncryptBeforeSigning policy</li></ul><h3 
id="SecurityAdvisories-2013">2013</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2013-2160.txt.asc?version=1&amp;modificationDate=1372324301000&amp;api=v2"
 data-linked-resource-id="33095710" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2013-2160.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="6
 3">CVE-2013-2160</a> - Denial of Service Attacks on Apache CXF</li><li><a 
shape="rect" href="cve-2012-5575.html">Note on CVE-2012-5575</a> - XML 
Encryption backwards compatibility attack on Apache CXF.</li><li><a 
shape="rect" href="cve-2013-0239.html">CVE-2013-0239</a> - Authentication 
bypass in the case of WS-SecurityPolicy enabled plaintext 
UsernameTokens.</li></ul><h3 id="SecurityAdvisories-2012">2012</h3><ul><li><a 
shape="rect" href="cve-2012-5633.html">CVE-2012-5633</a> - WSS4JInInterceptor 
always allows HTTP Get requests from browser.</li><li><a shape="rect" 
href="note-on-cve-2011-2487.html">Note on CVE-2011-2487</a> - Bleichenbacher 
attack against distributed symmetric key in WS-Security.</li><li><a 
shape="rect" href="cve-2012-3451.html">CVE-2012-3451</a> - Apache CXF is 
vulnerable to SOAP Action spoofing attacks on Document Literal web 
services.</li><li><a shape="rect" href="cve-2012-2379.html">CVE-2012-2379</a> - 
Apache CXF does not verify that elements were signed or encry
 pted by a particular Supporting Token.</li><li><a shape="rect" 
href="cve-2012-2378.html">CVE-2012-2378</a> - Apache CXF does not pick up some 
child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on 
the client side.</li><li><a shape="rect" href="note-on-cve-2011-1096.html">Note 
on CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding 
attack.</li><li><a shape="rect" href="cve-2012-0803.html">CVE-2012-0803</a> - 
Apache CXF does not validate UsernameToken policies correctly.</li></ul><h3 
id="SecurityAdvisories-2010">2010</h3><ul><li><a shape="rect" 
class="external-link" 
href="http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf";>CVE-2010-2076</a>
 - DTD based XML attacks.</li></ul><p><br clear="none"></p></div>
+<div id="ConfluenceContent"><p><span style="color: rgb(36,41,47);">For 
information on how to report a new security problem please 
see<span>&#160;</span></span><a shape="rect" class="external-link" 
href="https://www.apache.org/security/"; style="text-decoration: 
none;">here</a><span style="color: 
rgb(36,41,47);">.<span>&#160;</span></span></p><h3 
id="SecurityAdvisories-2026">2026</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2026-44417.txt?version=1&amp;modificationDate=1779445819000&amp;api=v2"
 data-linked-resource-id="429064531" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-44417.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-44417</a>: Apache 
CXF:Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to 
RCE)</li><li><a shape="rect" href="security-advi
 
sories.data/CVE-2026-44618.txt?version=1&amp;modificationDate=1779445877000&amp;api=v2"
 data-linked-resource-id="429064532" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-44618.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-44618</a>: Apache CXF: XXE 
vulnerability in WS-Transfer functionality</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-44930.txt?version=1&amp;modificationDate=1779445722000&amp;api=v2"
 data-linked-resource-id="429064529" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-44930.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-44930</a>: Apache CXF: 
LDAP Injectio
 n vulnerability in XKMS LDAP Repository</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-49875.txt?version=1&amp;modificationDate=1781192084000&amp;api=v2"
 data-linked-resource-id="430408836" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-49875.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-49875</a>: Apache CXF: XML 
External Entity (XXE) Injection in W3CMultiSchemaFactory and 
EndpointReferenceUtils&#160;</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50623.txt?version=1&amp;modificationDate=1781192231000&amp;api=v2"
 data-linked-resource-id="430408838" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50623.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" data
 -linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50623</a>: Apache CXF: 
Authentication Bypass in OAuth2 TokenIntrospectionService</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2026-50627.txt?version=1&amp;modificationDate=1781192281000&amp;api=v2"
 data-linked-resource-id="430408839" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50627.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50627</a>: Apache CXF: 
OAuth2: Missing JWT Audience and Issuer Validation in Access Token 
Validator</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50628.txt?version=1&amp;modificationDate=1781192316000&amp;api=v2"
 data-linked-resource-id="430408840" data-linked-resource-version="1" 
data-linked-resource-type="attachment" data-linked-reso
 urce-default-alias="CVE-2026-50628.txt" data-nice-type="Text File" 
data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50628</a>: Apache CXF: 
OAuth2: Inverted IP Binding Check Defeats Security Control</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2026-50629.txt?version=1&amp;modificationDate=1781192369000&amp;api=v2"
 data-linked-resource-id="430408842" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50629.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50629</a>: Apache CXF: 
OAuth2: Log Injection via Unsanitized Client Identifier</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50630.txt?version=1&amp;modificationDate=1781192413000&amp;api=v2"
 data-linked-resource-id="4
 30408843" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50630.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50630</a>: Apache CXF: 
OAuth2: HTTP Response Splitting via WWW-Authenticate Realm 
Injection&#160;</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50631.txt?version=1&amp;modificationDate=1781192445000&amp;api=v2"
 data-linked-resource-id="430408844" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50631.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50631</a>: Apache CXF: 
OAuth2: TOCTOU Race Condition in Refresh Token Processing</li><li><a 
shape="rect" href="security-ad
 
visories.data/CVE-2026-50632.txt?version=2&amp;modificationDate=1781197304000&amp;api=v2"
 data-linked-resource-id="430408845" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50632.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50632</a>: Apache CXF: 
JNDI Injection Vulnerability in JMSConfigFactory</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50633.txt?version=1&amp;modificationDate=1781192513000&amp;api=v2"
 data-linked-resource-id="430408847" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50633.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50633</a>: Apache CXF: 
JNDI Inje
 ction vulnerability in DispatchMDBMessageListenerImpl</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50634.txt?version=1&amp;modificationDate=1781192545000&amp;api=v2"
 data-linked-resource-id="430408848" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50634.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50634</a>: Apache CXF: WS 
JSON request filter trusts metadata from an unvalidated first signature 
entry</li><li><a shape="rect" 
href="security-advisories.data/CVE-2026-50645.txt?version=3&amp;modificationDate=1781197687000&amp;api=v2"
 data-linked-resource-id="430408849" data-linked-resource-version="3" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2026-50645.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" dat
 a-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2026-50645</a>: Apache CXF: No 
restriction on attachment headers per message</li></ul><h3 
id="SecurityAdvisories-2025">2025</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2025-23184.txt?version=2&amp;modificationDate=1737381863000&amp;api=v2"
 data-linked-resource-id="340036025" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2025-23184.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2025-23184</a>: Apache CXF: 
Denial of Service vulnerability with temporary files&#160;</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2025-48795.txt?version=1&amp;modificationDate=1752578416000&amp;api=v2"
 data-linked-resource-id="373886120" data-linked-resource-version="1" 
data-linked-resource-type="att
 achment" data-linked-resource-default-alias="CVE-2025-48795.txt" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2025-48795</a>: Apache CXF: 
Denial of Service and sensitive data exposure in logs&#160;</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2025-48913.txt?version=1&amp;modificationDate=1754576095000&amp;api=v2"
 data-linked-resource-id="373887565" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2025-48913.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2025-48913</a>: Apache CXF: 
Untrusted JMS configuration can lead to RCE&#160;</li></ul><h3 
id="SecurityAdvisories-2024">2024</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2024-28752.txt?version=2&am
 p;modificationDate=1710431346000&amp;api=v2" 
data-linked-resource-id="296290905" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-28752.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2024-28752</a>: Apache CXF SSRF 
Vulnerability using the Aegis databinding&#160;</li><li><a shape="rect" 
href="security-advisories.data/CVE-2024-29736.txt?version=1&amp;modificationDate=1721314668000&amp;api=v2"
 data-linked-resource-id="315493016" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-29736.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2024-29736</a>: SSRF 
vulnerability via WADL stylesheet parameter</li><li><a sha
 pe="rect" 
href="security-advisories.data/CVE-2024-32007.txt?version=1&amp;modificationDate=1721314761000&amp;api=v2"
 data-linked-resource-id="315493017" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-32007.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2024-32007</a>: Apache CXF 
Denial of Service vulnerability in JOSE</li><li><a shape="rect" 
href="security-advisories.data/CVE-2024-41172.txt?version=1&amp;modificationDate=1721314821000&amp;api=v2"
 data-linked-resource-id="315493018" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2024-41172.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2024-41172</a>: Unre
 stricted memory consumption in CXF HTTP clients</li></ul><h3 
id="SecurityAdvisories-2022">2022</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2022-46363.txt?version=1&amp;modificationDate=1670942001000&amp;api=v2"
 data-linked-resource-id="235836918" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2022-46363.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2022-46363</a>: Apache CXF 
directory listing / code exfiltration</li><li><a shape="rect" 
href="security-advisories.data/CVE-2022-46364.txt?version=1&amp;modificationDate=1670944473000&amp;api=v2"
 data-linked-resource-id="235836926" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2022-46364.txt" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" da
 ta-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2022-46364</a>: Apache CXF SSRF 
Vulnerability</li></ul><h3 id="SecurityAdvisories-2021">2021</h3><ul><li><a 
shape="rect" 
href="security-advisories.data/CVE-2021-30468.txt.asc?version=1&amp;modificationDate=1623835370000&amp;api=v2"
 data-linked-resource-id="181310680" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2021-30468.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2021-30468</a>: Apache CXF 
Denial of service vulnerability in parsing JSON via 
JsonMapObjectReaderWriter</li><li><a shape="rect" 
href="security-advisories.data/CVE-2021-22696.txt.asc?version=1&amp;modificationDate=1617355743000&amp;api=v2"
 data-linked-resource-id="177049091" data-linked-resource-version="1" 
data-linked-resource-type="att
 achment" data-linked-resource-default-alias="CVE-2021-22696.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2021-22696</a>: OAuth 2 
authorization service vulnerable to DDos attacks</li></ul><h3 
id="SecurityAdvisories-2020">2020</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2020-13954.txt.asc?version=1&amp;modificationDate=1605183671000&amp;api=v2"
 data-linked-resource-id="165225095" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2020-13954.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2020-13954</a>: Apache CXF 
Reflected XSS in the services listing page via the styleSheetPath</li><li><a 
shape="rect" href="security-advisories.data/CVE-2020-1954.txt.a
 sc?version=1&amp;modificationDate=1585730169000&amp;api=v2" 
data-linked-resource-id="148645097" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2020-1954.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2020-1954</a>: Apache CXF JMX 
Integration is vulnerable to a MITM attack</li></ul><h3 
id="SecurityAdvisories-2019">2019</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2019-17573.txt.asc?version=2&amp;modificationDate=1584610519000&amp;api=v2"
 data-linked-resource-id="145722246" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-17573.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2019-1757
 3</a>: Apache CXF Reflected XSS in the services listing page</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2019-12423.txt.asc?version=1&amp;modificationDate=1579178393000&amp;api=v2"
 data-linked-resource-id="145722244" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-12423.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2019-12423</a>: Apache CXF 
OpenId Connect JWK Keys service returns private/secret credentials if 
configured with a jwk keystore</li><li><a shape="rect" 
href="security-advisories.data/CVE-2019-12419.txt.asc?version=2&amp;modificationDate=1572961201000&amp;api=v2"
 data-linked-resource-id="135859612" data-linked-resource-version="2" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-12419.txt.asc" 
data-nice-type="Text File" data-lin
 ked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2019-12419</a>: Apache CXF 
OpenId Connect token service does not properly validate the clientId</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2019-12406.txt.asc?version=1&amp;modificationDate=1572957147000&amp;api=v2"
 data-linked-resource-id="135859607" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2019-12406.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2019-12406</a>: Apache CXF does 
not restrict the number of message attachments</li></ul><h3 
id="SecurityAdvisories-2018">2018</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2018-8039.txt.asc?version=1&amp;modificationDate=1530184663000&amp;api=v2"
 data-linked-resource-id="87296645" 
 data-linked-resource-version="1" data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2018-8039.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2018-8039</a>: Apache CXF TLS 
hostname verification does not work correctly with com.sun.net.ssl.</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2018-8038.txt.asc?version=1&amp;modificationDate=1530712328000&amp;api=v2"
 data-linked-resource-id="87297524" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2018-8038.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2018-8038</a>: Apache CXF Fediz 
is vulnerable to DTD based XML attacks</li></ul><h3 
id="SecurityAdvisories-2017">2017</h3><ul><li><a s
 hape="rect" 
href="security-advisories.data/CVE-2017-12631.txt.asc?version=1&amp;modificationDate=1512037276000&amp;api=v2"
 data-linked-resource-id="74688816" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-12631.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2017-12631</a>: CSRF 
vulnerabilities in the Apache CXF Fediz Spring plugins.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-12624.txt.asc?version=1&amp;modificationDate=1510661632000&amp;api=v2"
 data-linked-resource-id="74687100" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-12624.txt.asc" 
data-nice-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64
 ">CVE-2017-12624</a>: Apache CXF web services that process attachments are 
vulnerable to Denial of Service (DoS) attacks.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-7662.txt.asc?version=1&amp;modificationDate=1494949377000&amp;api=v2"
 data-linked-resource-id="70255583" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-7662.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2017-7662</a>: The Apache CXF 
Fediz OIDC Client Registration Service is vulnerable to CSRF 
attacks.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-7661.txt.asc?version=1&amp;modificationDate=1494949364000&amp;api=v2"
 data-linked-resource-id="70255582" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-7661.txt.asc" data-nic
 e-type="Text File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2017-7661</a>: The Apache CXF 
Fediz Jetty and Spring plugins are vulnerable to CSRF attacks.</li><li><a 
shape="rect" 
href="security-advisories.data/CVE-2017-5656.txt.asc?version=1&amp;modificationDate=1492515113000&amp;api=v2"
 data-linked-resource-id="69406543" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-5656.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2017-5656</a>: Apache CXF's 
STSClient uses a flawed way of caching tokens that are associated with 
delegation tokens.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-5653.txt.asc?version=1&amp;modificationDate=1492515074000&amp;api=v2"
 data-linked-resource-id="6
 9406542" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-5653.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2017-5653</a>: Apache CXF 
JAX-RS XML Security streaming clients do not validate that the service response 
was signed or encrypted.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2017-3156.txt.asc?version=1&amp;modificationDate=1487590374000&amp;api=v2"
 data-linked-resource-id="68715428" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2017-3156.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2017-3156</a>: Apache CXF 
OAuth2 Hawk and JOSE MAC Validation code is vulnerable to the timi
 ng attacks</li></ul><h3 id="SecurityAdvisories-2016">2016</h3><ul><li><a 
shape="rect" 
href="security-advisories.data/CVE-2016-8739.txt.asc?version=1&amp;modificationDate=1482164360000&amp;api=v2"
 data-linked-resource-id="67635454" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2016-8739.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2016-8739</a>: Atom entity 
provider of Apache CXF JAX-RS is vulnerable to XXE</li><li><a shape="rect" 
href="security-advisories.data/CVE-2016-6812.txt.asc?version=1&amp;modificationDate=1482164360000&amp;api=v2"
 data-linked-resource-id="67635455" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2016-6812.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" data-linked-reso
 urce-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2016-6812</a>: XSS risk in 
Apache CXF FormattedServiceListWriter when a request URL contains matrix 
parameters</li><li><a shape="rect" 
href="security-advisories.data/CVE-2016-4464.txt.asc?version=1&amp;modificationDate=1473350153000&amp;api=v2"
 data-linked-resource-id="65869472" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2016-4464.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2016-4464</a>: Apache CXF Fediz 
application plugins do not match the SAML AudienceRestriction values against 
the list of configured audience URIs</li></ul><h3 
id="SecurityAdvisories-2015">2015</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2015-5253.txt.asc?version=1&amp;modificationDate=1447433340000&amp;api=v2"
 data-linked
 -resource-id="61328642" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2015-5253.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2015-5253</a>: Apache CXF SAML 
SSO processing is vulnerable to a wrapping attack</li><li><a shape="rect" 
href="security-advisories.data/CVE-2015-5175.txt.asc?version=1&amp;modificationDate=1440598018000&amp;api=v2"
 data-linked-resource-id="61316328" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2015-5175.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2015-5175</a>: Apache CXF Fediz 
application plugins are vulnerable to Denial of Service (DoS) 
attacks</li></ul><h3 id="Security
 Advisories-2014">2014</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3577.txt.asc?version=1&amp;modificationDate=1419245371000&amp;api=v2"
 data-linked-resource-id="51183657" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-3577.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-3577</a>: Apache CXF SSL 
hostname verification bypass</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3566.txt.asc?version=1&amp;modificationDate=1418740474000&amp;api=v2"
 data-linked-resource-id="50561078" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-3566.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" data-linked-resource-conta
 iner-version="64">Note on CVE-2014-3566</a>: SSL 3.0 support in Apache CXF, 
aka the "POODLE" attack.</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3623.txt.asc?version=1&amp;modificationDate=1414169368000&amp;api=v2"
 data-linked-resource-id="47743195" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-3623.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-3623</a>: Apache CXF does 
not properly enforce the security semantics of SAML SubjectConfirmation methods 
when used with the TransportBinding</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-3584.txt.asc?version=1&amp;modificationDate=1414169326000&amp;api=v2"
 data-linked-resource-id="47743194" data-linked-resource-version="1" 
data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2
 014-3584.txt.asc" data-nice-type="Text File" 
data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-3584</a>: Apache CXF 
JAX-RS SAML handling is vulnerable to a Denial of Service (DoS) 
attack</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-0109.txt.asc?version=1&amp;modificationDate=1398873370000&amp;api=v2"
 data-linked-resource-id="40895138" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0109.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-0109</a>: HTML content 
posted to SOAP endpoint could cause OOM errors</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-0110.txt.asc?version=1&amp;modificationDate=1398873378000&amp;api=v2"
 data-linked-resource-id="40895139" data
 -linked-resource-version="1" data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0110.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-0110</a>: Large invalid 
content could cause temporary space to fill</li><li><a shape="rect" 
href="security-advisories.data/CVE-2014-0034.txt.asc?version=1&amp;modificationDate=1398873385000&amp;api=v2"
 data-linked-resource-id="40895140" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0034.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-0034</a>: The 
SecurityTokenService accepts certain invalid SAML Tokens as valid</li><li><a 
shape="rect" href="security-advisories.data/CVE-2014-0035.txt.asc?v
 ersion=1&amp;modificationDate=1398873391000&amp;api=v2" 
data-linked-resource-id="40895141" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2014-0035.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="64">CVE-2014-0035</a>: UsernameTokens 
are sent in plaintext with a Symmetric EncryptBeforeSigning policy</li></ul><h3 
id="SecurityAdvisories-2013">2013</h3><ul><li><a shape="rect" 
href="security-advisories.data/CVE-2013-2160.txt.asc?version=1&amp;modificationDate=1372324301000&amp;api=v2"
 data-linked-resource-id="33095710" data-linked-resource-version="1" 
data-linked-resource-type="attachment" 
data-linked-resource-default-alias="CVE-2013-2160.txt.asc" data-nice-type="Text 
File" data-linked-resource-content-type="text/plain" 
data-linked-resource-container-id="27837502" 
data-linked-resource-container-version="6
 4">CVE-2013-2160</a> - Denial of Service Attacks on Apache CXF</li><li><a 
shape="rect" href="cve-2012-5575.html">Note on CVE-2012-5575</a> - XML 
Encryption backwards compatibility attack on Apache CXF.</li><li><a 
shape="rect" href="cve-2013-0239.html">CVE-2013-0239</a> - Authentication 
bypass in the case of WS-SecurityPolicy enabled plaintext 
UsernameTokens.</li></ul><h3 id="SecurityAdvisories-2012">2012</h3><ul><li><a 
shape="rect" href="cve-2012-5633.html">CVE-2012-5633</a> - WSS4JInInterceptor 
always allows HTTP Get requests from browser.</li><li><a shape="rect" 
href="note-on-cve-2011-2487.html">Note on CVE-2011-2487</a> - Bleichenbacher 
attack against distributed symmetric key in WS-Security.</li><li><a 
shape="rect" href="cve-2012-3451.html">CVE-2012-3451</a> - Apache CXF is 
vulnerable to SOAP Action spoofing attacks on Document Literal web 
services.</li><li><a shape="rect" href="cve-2012-2379.html">CVE-2012-2379</a> - 
Apache CXF does not verify that elements were signed or encry
 pted by a particular Supporting Token.</li><li><a shape="rect" 
href="cve-2012-2378.html">CVE-2012-2378</a> - Apache CXF does not pick up some 
child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on 
the client side.</li><li><a shape="rect" href="note-on-cve-2011-1096.html">Note 
on CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding 
attack.</li><li><a shape="rect" href="cve-2012-0803.html">CVE-2012-0803</a> - 
Apache CXF does not validate UsernameToken policies correctly.</li></ul><h3 
id="SecurityAdvisories-2010">2010</h3><ul><li><a shape="rect" 
class="external-link" 
href="http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf";>CVE-2010-2076</a>
 - DTD based XML attacks.</li></ul><p><br clear="none"></p></div>
            </div>
            <!-- Content -->
          </td>