Author: buildbot Date: Thu Aug 6 10:43:11 2026 New Revision: 1093640 Log: Production update by buildbot for cxf
Added: websites/production/cxf/content/security-advisories.data/CVE-2026-54225.txt websites/production/cxf/content/security-advisories.data/CVE-2026-57817.txt websites/production/cxf/content/security-advisories.data/CVE-2026-57818.txt websites/production/cxf/content/security-advisories.data/CVE-2026-57819.txt websites/production/cxf/content/security-advisories.data/CVE-2026-61466.txt websites/production/cxf/content/security-advisories.data/CVE-2026-63687.txt websites/production/cxf/content/security-advisories.data/CVE-2026-64958.txt websites/production/cxf/content/security-advisories.data/CVE-2026-65432.txt websites/production/cxf/content/security-advisories.data/CVE-2026-66909.txt Modified: websites/production/cxf/content/cache/main.pageCache websites/production/cxf/content/security-advisories.html Modified: websites/production/cxf/content/cache/main.pageCache ============================================================================== Binary file (source and/or target). No diff available. Added: websites/production/cxf/content/security-advisories.data/CVE-2026-54225.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-54225.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,18 @@ +CVE-2026-54225: Apache CXF: Denial of Service attack via large attachments + +Severity: low + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-core) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-core) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-core) before 3.6.12 + +Description: + +Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb. + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-54225 Added: websites/production/cxf/content/security-advisories.data/CVE-2026-57817.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-57817.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,22 @@ +CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow + +Severity: low + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) before 3.6.12 + +Description: + +The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Guanping Zhang reported this vulnerability. (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-57817 Added: websites/production/cxf/content/security-advisories.data/CVE-2026-57818.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-57818.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,23 @@ +CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider + +Severity: low + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 3.6.12 + +Description: + +A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Guanping Zhang reported this vulnerability (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-57818 + Added: websites/production/cxf/content/security-advisories.data/CVE-2026-57819.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-57819.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,18 @@ +CVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per message + +Severity: low + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-frontend-jaxrs) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-rt-frontend-jaxrs) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-frontend-jaxrs) before 3.6.12 + +Description: + +Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters. + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-57819 Added: websites/production/cxf/content/security-advisories.data/CVE-2026-61466.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-61466.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,22 @@ +CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation + +Severity: moderate + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 3.6.12 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.3 + +Description: + +In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Guanping Zhang reported this vulnerability. (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-61466 Added: websites/production/cxf/content/security-advisories.data/CVE-2026-63687.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-63687.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,22 @@ +CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters + +Severity: low + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 3.6.12 + +Description: + +Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Guanping Zhang reported this vulnerability. (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-63687 Added: websites/production/cxf/content/security-advisories.data/CVE-2026-64958.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-64958.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,22 @@ +CVE-2026-64958: Apache CXF: Denial of service via message header attachments + +Severity: moderate + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-core) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-core) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-core) before 3.6.12 + +Description: + +An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Markus Vogl, RISE GmbH (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-64958 Added: websites/production/cxf/content/security-advisories.data/CVE-2026-65432.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-65432.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,23 @@ +CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing + +Severity: important + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-wsdl) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-rt-wsdl) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-wsdl) before 3.6.12 + +Description: + +Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Reported by n0mi1k (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-65432 + Added: websites/production/cxf/content/security-advisories.data/CVE-2026-66909.txt ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ websites/production/cxf/content/security-advisories.data/CVE-2026-66909.txt Thu Aug 6 10:43:11 2026 (r1093640) @@ -0,0 +1,22 @@ +CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage + +Severity: important + +Affected versions: + +- Apache CXF (org.apache.cxf:cxf-rt-transports-jms) 4.2.0 before 4.2.3 +- Apache CXF (org.apache.cxf:cxf-rt-transports-jms) 4.0.0 before 4.1.8 +- Apache CXF (org.apache.cxf:cxf-rt-transports-jms) before 3.6.12 + +Description: + +Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. + +Credit: + +Reported by n0mi1k (finder) + +References: + +https://cxf.apache.org/ +https://www.cve.org/CVERecord?id=CVE-2026-66909 Modified: websites/production/cxf/content/security-advisories.html ============================================================================== --- websites/production/cxf/content/security-advisories.html Thu Aug 6 07:47:07 2026 (r1093639) +++ websites/production/cxf/content/security-advisories.html Thu Aug 6 10:43:11 2026 (r1093640) @@ -99,7 +99,7 @@ Apache CXF -- Security Advisories <td height="100%"> <!-- Content --> <div class="wiki-content"> -<div id="ConfluenceContent"><p><span style="color: rgb(36,41,47);">For information on how to report a new security problem please see<span> </span></span><a shape="rect" class="external-link" href="https://www.apache.org/security/"; style="text-decoration: none;">here</a><span style="color: rgb(36,41,47);">.<span> </span></span></p><h3 id="SecurityAdvisories-2026">2026</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2026-44417.txt?version=1&modificationDate=1779445819000&api=v2" data-linked-resource-id="429064531" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-44417.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-44417</a>: Apache CXF:Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)</li><li><a shape="rect" href="security-advi sories.data/CVE-2026-44618.txt?version=1&modificationDate=1779445877000&api=v2" data-linked-resource-id="429064532" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-44618.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-44618</a>: Apache CXF: XXE vulnerability in WS-Transfer functionality</li><li><a shape="rect" href="security-advisories.data/CVE-2026-44930.txt?version=1&modificationDate=1779445722000&api=v2" data-linked-resource-id="429064529" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-44930.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-44930</a>: Apache CXF: LDAP Injectio n vulnerability in XKMS LDAP Repository</li><li><a shape="rect" href="security-advisories.data/CVE-2026-49875.txt?version=1&modificationDate=1781192084000&api=v2" data-linked-resource-id="430408836" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-49875.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-49875</a>: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils </li><li><a shape="rect" href="security-advisories.data/CVE-2026-50623.txt?version=1&modificationDate=1781192231000&api=v2" data-linked-resource-id="430408838" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50623.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data -linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50623</a>: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50627.txt?version=1&modificationDate=1781192281000&api=v2" data-linked-resource-id="430408839" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50627.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50627</a>: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50628.txt?version=1&modificationDate=1781192316000&api=v2" data-linked-resource-id="430408840" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-reso urce-default-alias="CVE-2026-50628.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50628</a>: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50629.txt?version=1&modificationDate=1781192369000&api=v2" data-linked-resource-id="430408842" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50629.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50629</a>: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50630.txt?version=1&modificationDate=1781192413000&api=v2" data-linked-resource-id="4 30408843" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50630.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50630</a>: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection </li><li><a shape="rect" href="security-advisories.data/CVE-2026-50631.txt?version=1&modificationDate=1781192445000&api=v2" data-linked-resource-id="430408844" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50631.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50631</a>: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing</li><li><a shape="rect" href="security-ad visories.data/CVE-2026-50632.txt?version=2&modificationDate=1781197304000&api=v2" data-linked-resource-id="430408845" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50632.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50632</a>: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50633.txt?version=1&modificationDate=1781192513000&api=v2" data-linked-resource-id="430408847" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50633.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50633</a>: Apache CXF: JNDI Inje ction vulnerability in DispatchMDBMessageListenerImpl</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50634.txt?version=1&modificationDate=1781192545000&api=v2" data-linked-resource-id="430408848" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50634.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50634</a>: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50645.txt?version=3&modificationDate=1781197687000&api=v2" data-linked-resource-id="430408849" data-linked-resource-version="3" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50645.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" dat a-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2026-50645</a>: Apache CXF: No restriction on attachment headers per message</li></ul><h3 id="SecurityAdvisories-2025">2025</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2025-23184.txt?version=2&modificationDate=1737381863000&api=v2" data-linked-resource-id="340036025" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2025-23184.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2025-23184</a>: Apache CXF: Denial of Service vulnerability with temporary files </li><li><a shape="rect" href="security-advisories.data/CVE-2025-48795.txt?version=1&modificationDate=1752578416000&api=v2" data-linked-resource-id="373886120" data-linked-resource-version="1" data-linked-resource-type="att achment" data-linked-resource-default-alias="CVE-2025-48795.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2025-48795</a>: Apache CXF: Denial of Service and sensitive data exposure in logs </li><li><a shape="rect" href="security-advisories.data/CVE-2025-48913.txt?version=1&modificationDate=1754576095000&api=v2" data-linked-resource-id="373887565" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2025-48913.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2025-48913</a>: Apache CXF: Untrusted JMS configuration can lead to RCE </li></ul><h3 id="SecurityAdvisories-2024">2024</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2024-28752.txt?version=2&am p;modificationDate=1710431346000&api=v2" data-linked-resource-id="296290905" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-28752.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2024-28752</a>: Apache CXF SSRF Vulnerability using the Aegis databinding </li><li><a shape="rect" href="security-advisories.data/CVE-2024-29736.txt?version=1&modificationDate=1721314668000&api=v2" data-linked-resource-id="315493016" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-29736.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2024-29736</a>: SSRF vulnerability via WADL stylesheet parameter</li><li><a sha pe="rect" href="security-advisories.data/CVE-2024-32007.txt?version=1&modificationDate=1721314761000&api=v2" data-linked-resource-id="315493017" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-32007.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2024-32007</a>: Apache CXF Denial of Service vulnerability in JOSE</li><li><a shape="rect" href="security-advisories.data/CVE-2024-41172.txt?version=1&modificationDate=1721314821000&api=v2" data-linked-resource-id="315493018" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-41172.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2024-41172</a>: Unre stricted memory consumption in CXF HTTP clients</li></ul><h3 id="SecurityAdvisories-2022">2022</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2022-46363.txt?version=1&modificationDate=1670942001000&api=v2" data-linked-resource-id="235836918" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2022-46363.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2022-46363</a>: Apache CXF directory listing / code exfiltration</li><li><a shape="rect" href="security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944473000&api=v2" data-linked-resource-id="235836926" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2022-46364.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" da ta-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2022-46364</a>: Apache CXF SSRF Vulnerability</li></ul><h3 id="SecurityAdvisories-2021">2021</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2021-30468.txt.asc?version=1&modificationDate=1623835370000&api=v2" data-linked-resource-id="181310680" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2021-30468.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2021-30468</a>: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter</li><li><a shape="rect" href="security-advisories.data/CVE-2021-22696.txt.asc?version=1&modificationDate=1617355743000&api=v2" data-linked-resource-id="177049091" data-linked-resource-version="1" data-linked-resource-type="att achment" data-linked-resource-default-alias="CVE-2021-22696.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2021-22696</a>: OAuth 2 authorization service vulnerable to DDos attacks</li></ul><h3 id="SecurityAdvisories-2020">2020</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2020-13954.txt.asc?version=1&modificationDate=1605183671000&api=v2" data-linked-resource-id="165225095" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2020-13954.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2020-13954</a>: Apache CXF Reflected XSS in the services listing page via the styleSheetPath</li><li><a shape="rect" href="security-advisories.data/CVE-2020-1954.txt.a sc?version=1&modificationDate=1585730169000&api=v2" data-linked-resource-id="148645097" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2020-1954.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2020-1954</a>: Apache CXF JMX Integration is vulnerable to a MITM attack</li></ul><h3 id="SecurityAdvisories-2019">2019</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2019-17573.txt.asc?version=2&modificationDate=1584610519000&api=v2" data-linked-resource-id="145722246" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-17573.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2019-1757 3</a>: Apache CXF Reflected XSS in the services listing page</li><li><a shape="rect" href="security-advisories.data/CVE-2019-12423.txt.asc?version=1&modificationDate=1579178393000&api=v2" data-linked-resource-id="145722244" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-12423.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2019-12423</a>: Apache CXF OpenId Connect JWK Keys service returns private/secret credentials if configured with a jwk keystore</li><li><a shape="rect" href="security-advisories.data/CVE-2019-12419.txt.asc?version=2&modificationDate=1572961201000&api=v2" data-linked-resource-id="135859612" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-12419.txt.asc" data-nice-type="Text File" data-lin ked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2019-12419</a>: Apache CXF OpenId Connect token service does not properly validate the clientId</li><li><a shape="rect" href="security-advisories.data/CVE-2019-12406.txt.asc?version=1&modificationDate=1572957147000&api=v2" data-linked-resource-id="135859607" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-12406.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2019-12406</a>: Apache CXF does not restrict the number of message attachments</li></ul><h3 id="SecurityAdvisories-2018">2018</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2" data-linked-resource-id="87296645" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2018-8039.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2018-8039</a>: Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.</li><li><a shape="rect" href="security-advisories.data/CVE-2018-8038.txt.asc?version=1&modificationDate=1530712328000&api=v2" data-linked-resource-id="87297524" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2018-8038.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2018-8038</a>: Apache CXF Fediz is vulnerable to DTD based XML attacks</li></ul><h3 id="SecurityAdvisories-2017">2017</h3><ul><li><a s hape="rect" href="security-advisories.data/CVE-2017-12631.txt.asc?version=1&modificationDate=1512037276000&api=v2" data-linked-resource-id="74688816" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-12631.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2017-12631</a>: CSRF vulnerabilities in the Apache CXF Fediz Spring plugins.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-12624.txt.asc?version=1&modificationDate=1510661632000&api=v2" data-linked-resource-id="74687100" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-12624.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64 ">CVE-2017-12624</a>: Apache CXF web services that process attachments are vulnerable to Denial of Service (DoS) attacks.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-7662.txt.asc?version=1&modificationDate=1494949377000&api=v2" data-linked-resource-id="70255583" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-7662.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2017-7662</a>: The Apache CXF Fediz OIDC Client Registration Service is vulnerable to CSRF attacks.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-7661.txt.asc?version=1&modificationDate=1494949364000&api=v2" data-linked-resource-id="70255582" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-7661.txt.asc" data-nic e-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2017-7661</a>: The Apache CXF Fediz Jetty and Spring plugins are vulnerable to CSRF attacks.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-5656.txt.asc?version=1&modificationDate=1492515113000&api=v2" data-linked-resource-id="69406543" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-5656.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2017-5656</a>: Apache CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-5653.txt.asc?version=1&modificationDate=1492515074000&api=v2" data-linked-resource-id="6 9406542" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-5653.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2017-5653</a>: Apache CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-3156.txt.asc?version=1&modificationDate=1487590374000&api=v2" data-linked-resource-id="68715428" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-3156.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2017-3156</a>: Apache CXF OAuth2 Hawk and JOSE MAC Validation code is vulnerable to the timi ng attacks</li></ul><h3 id="SecurityAdvisories-2016">2016</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2016-8739.txt.asc?version=1&modificationDate=1482164360000&api=v2" data-linked-resource-id="67635454" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2016-8739.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2016-8739</a>: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE</li><li><a shape="rect" href="security-advisories.data/CVE-2016-6812.txt.asc?version=1&modificationDate=1482164360000&api=v2" data-linked-resource-id="67635455" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2016-6812.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-reso urce-container-id="27837502" data-linked-resource-container-version="64">CVE-2016-6812</a>: XSS risk in Apache CXF FormattedServiceListWriter when a request URL contains matrix parameters</li><li><a shape="rect" href="security-advisories.data/CVE-2016-4464.txt.asc?version=1&modificationDate=1473350153000&api=v2" data-linked-resource-id="65869472" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2016-4464.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2016-4464</a>: Apache CXF Fediz application plugins do not match the SAML AudienceRestriction values against the list of configured audience URIs</li></ul><h3 id="SecurityAdvisories-2015">2015</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2015-5253.txt.asc?version=1&modificationDate=1447433340000&api=v2" data-linked -resource-id="61328642" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2015-5253.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2015-5253</a>: Apache CXF SAML SSO processing is vulnerable to a wrapping attack</li><li><a shape="rect" href="security-advisories.data/CVE-2015-5175.txt.asc?version=1&modificationDate=1440598018000&api=v2" data-linked-resource-id="61316328" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2015-5175.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2015-5175</a>: Apache CXF Fediz application plugins are vulnerable to Denial of Service (DoS) attacks</li></ul><h3 id="Security Advisories-2014">2014</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2014-3577.txt.asc?version=1&modificationDate=1419245371000&api=v2" data-linked-resource-id="51183657" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3577.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-3577</a>: Apache CXF SSL hostname verification bypass</li><li><a shape="rect" href="security-advisories.data/CVE-2014-3566.txt.asc?version=1&modificationDate=1418740474000&api=v2" data-linked-resource-id="50561078" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3566.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-conta iner-version="64">Note on CVE-2014-3566</a>: SSL 3.0 support in Apache CXF, aka the "POODLE" attack.</li><li><a shape="rect" href="security-advisories.data/CVE-2014-3623.txt.asc?version=1&modificationDate=1414169368000&api=v2" data-linked-resource-id="47743195" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3623.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-3623</a>: Apache CXF does not properly enforce the security semantics of SAML SubjectConfirmation methods when used with the TransportBinding</li><li><a shape="rect" href="security-advisories.data/CVE-2014-3584.txt.asc?version=1&modificationDate=1414169326000&api=v2" data-linked-resource-id="47743194" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2 014-3584.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-3584</a>: Apache CXF JAX-RS SAML handling is vulnerable to a Denial of Service (DoS) attack</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370000&api=v2" data-linked-resource-id="40895138" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0109.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-0109</a>: HTML content posted to SOAP endpoint could cause OOM errors</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378000&api=v2" data-linked-resource-id="40895139" data -linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0110.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-0110</a>: Large invalid content could cause temporary space to fill</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0034.txt.asc?version=1&modificationDate=1398873385000&api=v2" data-linked-resource-id="40895140" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0034.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-0034</a>: The SecurityTokenService accepts certain invalid SAML Tokens as valid</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0035.txt.asc?v ersion=1&modificationDate=1398873391000&api=v2" data-linked-resource-id="40895141" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0035.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="64">CVE-2014-0035</a>: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy</li></ul><h3 id="SecurityAdvisories-2013">2013</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2013-2160.txt.asc?version=1&modificationDate=1372324301000&api=v2" data-linked-resource-id="33095710" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2013-2160.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="6 4">CVE-2013-2160</a> - Denial of Service Attacks on Apache CXF</li><li><a shape="rect" href="cve-2012-5575.html">Note on CVE-2012-5575</a> - XML Encryption backwards compatibility attack on Apache CXF.</li><li><a shape="rect" href="cve-2013-0239.html">CVE-2013-0239</a> - Authentication bypass in the case of WS-SecurityPolicy enabled plaintext UsernameTokens.</li></ul><h3 id="SecurityAdvisories-2012">2012</h3><ul><li><a shape="rect" href="cve-2012-5633.html">CVE-2012-5633</a> - WSS4JInInterceptor always allows HTTP Get requests from browser.</li><li><a shape="rect" href="note-on-cve-2011-2487.html">Note on CVE-2011-2487</a> - Bleichenbacher attack against distributed symmetric key in WS-Security.</li><li><a shape="rect" href="cve-2012-3451.html">CVE-2012-3451</a> - Apache CXF is vulnerable to SOAP Action spoofing attacks on Document Literal web services.</li><li><a shape="rect" href="cve-2012-2379.html">CVE-2012-2379</a> - Apache CXF does not verify that elements were signed or encry pted by a particular Supporting Token.</li><li><a shape="rect" href="cve-2012-2378.html">CVE-2012-2378</a> - Apache CXF does not pick up some child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on the client side.</li><li><a shape="rect" href="note-on-cve-2011-1096.html">Note on CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding attack.</li><li><a shape="rect" href="cve-2012-0803.html">CVE-2012-0803</a> - Apache CXF does not validate UsernameToken policies correctly.</li></ul><h3 id="SecurityAdvisories-2010">2010</h3><ul><li><a shape="rect" class="external-link" href="http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf";>CVE-2010-2076</a> - DTD based XML attacks.</li></ul><p><br clear="none"></p></div> +<div id="ConfluenceContent"><p><span style="color:var(--ds-text,#333333);">For information on how to report a new security problem please see<span> </span></span><a shape="rect" class="external-link" href="https://www.apache.org/security/"; style="text-decoration: none;">here</a><span style="color:var(--ds-text,#333333);">.<span> </span></span></p><h3 id="SecurityAdvisories-2026">2026</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2026-44417.txt?version=1&modificationDate=1779445819000&api=v2" data-linked-resource-id="429064531" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-44417.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-44417</a>: Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)</li><li><a shape="rect" hr ef="security-advisories.data/CVE-2026-44618.txt?version=1&modificationDate=1779445877000&api=v2" data-linked-resource-id="429064532" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-44618.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-44618</a>: Apache CXF: XXE vulnerability in WS-Transfer functionality</li><li><a shape="rect" href="security-advisories.data/CVE-2026-44930.txt?version=1&modificationDate=1779445722000&api=v2" data-linked-resource-id="429064529" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-44930.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-44930</a>: Apache C XF: LDAP Injection vulnerability in XKMS LDAP Repository</li><li><a shape="rect" href="security-advisories.data/CVE-2026-49875.txt?version=1&modificationDate=1781192084000&api=v2" data-linked-resource-id="430408836" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-49875.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-49875</a>: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils </li><li><a shape="rect" href="security-advisories.data/CVE-2026-50623.txt?version=1&modificationDate=1781192231000&api=v2" data-linked-resource-id="430408838" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50623.txt" data-nice-type="Text File" data-linked-resource-content-type= "text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50623</a>: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50627.txt?version=1&modificationDate=1781192281000&api=v2" data-linked-resource-id="430408839" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50627.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50627</a>: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50628.txt?version=1&modificationDate=1781192316000&api=v2" data-linked-resource-id="430408840" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50628.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50628</a>: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50629.txt?version=1&modificationDate=1781192369000&api=v2" data-linked-resource-id="430408842" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50629.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50629</a>: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50630.txt?version=1&modificationDate=1781192413000&api=v2" data-link ed-resource-id="430408843" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50630.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50630</a>: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection </li><li><a shape="rect" href="security-advisories.data/CVE-2026-50631.txt?version=1&modificationDate=1781192445000&api=v2" data-linked-resource-id="430408844" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50631.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50631</a>: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50632.txt?version=2&modificationDate=1781197304000&api=v2" data-linked-resource-id="430408845" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50632.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50632</a>: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50633.txt?version=1&modificationDate=1781192513000&api=v2" data-linked-resource-id="430408847" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50633.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50633</a>: Apac he CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50634.txt?version=1&modificationDate=1781192545000&api=v2" data-linked-resource-id="430408848" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50634.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50634</a>: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry</li><li><a shape="rect" href="security-advisories.data/CVE-2026-50645.txt?version=3&modificationDate=1781197687000&api=v2" data-linked-resource-id="430408849" data-linked-resource-version="3" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-50645.txt" data-nice-type="Text File" data-linked-resource-content-type ="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-50645</a>: Apache CXF: No restriction on attachment headers per message</li><li data-uuid="49670750-d78a-4fe2-a830-cc372623486a"><a shape="rect" href="security-advisories.data/CVE-2026-54225.txt?version=1&modificationDate=1786010395000&api=v2" data-linked-resource-id="446071159" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-54225.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-54225</a>: Apache CXF: Denial of Service attack via large attachments</li><li data-uuid="4d3b7d2a-2f95-4a2a-a0a4-16f3020d96a7"><a shape="rect" href="security-advisories.data/CVE-2026-57817.txt?version=1&modificationDate=1786011692000&api=v2" data-linked-resource-id="446071172" data-linked -resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-57817.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-57817</a>: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow</li><li data-uuid="421dab32-bb7b-4d04-a713-bf4012dab629"><a shape="rect" href="security-advisories.data/CVE-2026-57818.txt?version=1&modificationDate=1786011946000&api=v2" data-linked-resource-id="446071174" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-57818.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-57818</a>: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvide r</li><li data-uuid="9d893f5b-4577-4891-9f8a-c2a20c2a5a4d"><a shape="rect" href="security-advisories.data/CVE-2026-57819.txt?version=1&modificationDate=1786010722000&api=v2" data-linked-resource-id="446071161" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-57819.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-57819</a>: Apache CXF: No default restriction on the amount of form parameters per message</li><li data-uuid="37f9ccab-4420-47c2-9438-12b46f6066e1"><a shape="rect" href="security-advisories.data/CVE-2026-61466.txt?version=1&modificationDate=1786012193000&api=v2" data-linked-resource-id="446071176" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-61466.txt" data-nice-type="Text File" data-linked-resou rce-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-61466</a>: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation</li><li data-uuid="7c0ccedd-3bf8-4f26-993b-1ee8e96c74a4"><a shape="rect" href="security-advisories.data/CVE-2026-63687.txt?version=2&modificationDate=1786012916381&api=v2" data-linked-resource-id="446071178" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-63687.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-63687</a>: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters</li><li data-uuid="497c4f06-b436-4629-aa2d-e022a5268c29"><a shape="rect" href="security-advisories.data/CVE-2026-64958.txt?version=1&modificationDate=1786011007000&api=v2 " data-linked-resource-id="446071164" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-64958.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-64958</a>: Apache CXF: Denial of service via message header attachments</li><li data-uuid="b0b1eaaa-380b-4004-acbf-c135ef8b97e1"><a shape="rect" href="security-advisories.data/CVE-2026-65432.txt?version=1&modificationDate=1786011271000&api=v2" data-linked-resource-id="446071166" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-65432.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-65432</a>: Apache CXF: XXE via WSDL/XSD import parsing</li><li data-uui d="2693b482-0db3-4743-aa55-aec24d4be213"><a shape="rect" href="security-advisories.data/CVE-2026-66909.txt?version=2&modificationDate=1786011477000&api=v2" data-linked-resource-id="446071168" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2026-66909.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2026-66909</a>: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage</li></ul><h3 id="SecurityAdvisories-2025">2025</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2025-23184.txt?version=2&modificationDate=1737381863000&api=v2" data-linked-resource-id="340036025" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2025-23184.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" da ta-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2025-23184</a>: Apache CXF: Denial of Service vulnerability with temporary files </li><li><a shape="rect" href="security-advisories.data/CVE-2025-48795.txt?version=1&modificationDate=1752578416000&api=v2" data-linked-resource-id="373886120" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2025-48795.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2025-48795</a>: Apache CXF: Denial of Service and sensitive data exposure in logs </li><li><a shape="rect" href="security-advisories.data/CVE-2025-48913.txt?version=1&modificationDate=1754576095000&api=v2" data-linked-resource-id="373887565" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-a lias="CVE-2025-48913.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2025-48913</a>: Apache CXF: Untrusted JMS configuration can lead to RCE </li></ul><h3 id="SecurityAdvisories-2024">2024</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2024-28752.txt?version=2&modificationDate=1710431346000&api=v2" data-linked-resource-id="296290905" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-28752.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2024-28752</a>: Apache CXF SSRF Vulnerability using the Aegis databinding </li><li><a shape="rect" href="security-advisories.data/CVE-2024-29736.txt?version=1&modificationDate=1721314668000&api=v2" da ta-linked-resource-id="315493016" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-29736.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2024-29736</a>: SSRF vulnerability via WADL stylesheet parameter</li><li><a shape="rect" href="security-advisories.data/CVE-2024-32007.txt?version=1&modificationDate=1721314761000&api=v2" data-linked-resource-id="315493017" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-32007.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2024-32007</a>: Apache CXF Denial of Service vulnerability in JOSE</li><li><a shape="rect" href="security-advisories.data/CVE-2024-41172.txt? version=1&modificationDate=1721314821000&api=v2" data-linked-resource-id="315493018" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2024-41172.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2024-41172</a>: Unrestricted memory consumption in CXF HTTP clients</li></ul><h3 id="SecurityAdvisories-2022">2022</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2022-46363.txt?version=1&modificationDate=1670942001000&api=v2" data-linked-resource-id="235836918" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2022-46363.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2022-46363</a>: Apache CXF d irectory listing / code exfiltration</li><li><a shape="rect" href="security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944473000&api=v2" data-linked-resource-id="235836926" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2022-46364.txt" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2022-46364</a>: Apache CXF SSRF Vulnerability</li></ul><h3 id="SecurityAdvisories-2021">2021</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2021-30468.txt.asc?version=1&modificationDate=1623835370000&api=v2" data-linked-resource-id="181310680" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2021-30468.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-con tainer-id="27837502" data-linked-resource-container-version="77">CVE-2021-30468</a>: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter</li><li><a shape="rect" href="security-advisories.data/CVE-2021-22696.txt.asc?version=1&modificationDate=1617355743000&api=v2" data-linked-resource-id="177049091" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2021-22696.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2021-22696</a>: OAuth 2 authorization service vulnerable to DDos attacks</li></ul><h3 id="SecurityAdvisories-2020">2020</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2020-13954.txt.asc?version=1&modificationDate=1605183671000&api=v2" data-linked-resource-id="165225095" data-linked-resource-version="1" data-linked-resource-type ="attachment" data-linked-resource-default-alias="CVE-2020-13954.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2020-13954</a>: Apache CXF Reflected XSS in the services listing page via the styleSheetPath</li><li><a shape="rect" href="security-advisories.data/CVE-2020-1954.txt.asc?version=1&modificationDate=1585730169000&api=v2" data-linked-resource-id="148645097" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2020-1954.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2020-1954</a>: Apache CXF JMX Integration is vulnerable to a MITM attack</li></ul><h3 id="SecurityAdvisories-2019">2019</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2019-17573.t xt.asc?version=2&modificationDate=1584610519000&api=v2" data-linked-resource-id="145722246" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-17573.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2019-17573</a>: Apache CXF Reflected XSS in the services listing page</li><li><a shape="rect" href="security-advisories.data/CVE-2019-12423.txt.asc?version=1&modificationDate=1579178393000&api=v2" data-linked-resource-id="145722244" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-12423.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2019-12423</a>: Apache CXF OpenId Connect JWK Keys service returns private/secret credentials if configured with a jwk keystore</li><li><a shape="rect" href="security-advisories.data/CVE-2019-12419.txt.asc?version=2&modificationDate=1572961201000&api=v2" data-linked-resource-id="135859612" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-12419.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2019-12419</a>: Apache CXF OpenId Connect token service does not properly validate the clientId</li><li><a shape="rect" href="security-advisories.data/CVE-2019-12406.txt.asc?version=1&modificationDate=1572957147000&api=v2" data-linked-resource-id="135859607" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2019-12406.txt.asc" data-nice-type="Text File" data-linked-resource-content-ty pe="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2019-12406</a>: Apache CXF does not restrict the number of message attachments</li></ul><h3 id="SecurityAdvisories-2018">2018</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2" data-linked-resource-id="87296645" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2018-8039.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2018-8039</a>: Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.</li><li><a shape="rect" href="security-advisories.data/CVE-2018-8038.txt.asc?version=1&modificationDate=1530712328000&api=v2" data-linked-resource-id="87297524" data-linked-resource-ver sion="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2018-8038.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2018-8038</a>: Apache CXF Fediz is vulnerable to DTD based XML attacks</li></ul><h3 id="SecurityAdvisories-2017">2017</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2017-12631.txt.asc?version=1&modificationDate=1512037276000&api=v2" data-linked-resource-id="74688816" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-12631.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2017-12631</a>: CSRF vulnerabilities in the Apache CXF Fediz Spring plugins.</li><li><a shape="rect" href="security-advisories.data/ CVE-2017-12624.txt.asc?version=1&modificationDate=1510661632000&api=v2" data-linked-resource-id="74687100" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-12624.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2017-12624</a>: Apache CXF web services that process attachments are vulnerable to Denial of Service (DoS) attacks.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-7662.txt.asc?version=1&modificationDate=1494949377000&api=v2" data-linked-resource-id="70255583" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-7662.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE- 2017-7662</a>: The Apache CXF Fediz OIDC Client Registration Service is vulnerable to CSRF attacks.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-7661.txt.asc?version=1&modificationDate=1494949364000&api=v2" data-linked-resource-id="70255582" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-7661.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2017-7661</a>: The Apache CXF Fediz Jetty and Spring plugins are vulnerable to CSRF attacks.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-5656.txt.asc?version=1&modificationDate=1492515113000&api=v2" data-linked-resource-id="69406543" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-5656.txt.asc" data-nice-type="Text File" data-linke d-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2017-5656</a>: Apache CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-5653.txt.asc?version=1&modificationDate=1492515074000&api=v2" data-linked-resource-id="69406542" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-5653.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2017-5653</a>: Apache CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted.</li><li><a shape="rect" href="security-advisories.data/CVE-2017-3156.txt.asc?version=1&modificationDate=1487590374000&api=v2" data-linked-resou rce-id="68715428" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2017-3156.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2017-3156</a>: Apache CXF OAuth2 Hawk and JOSE MAC Validation code is vulnerable to the timing attacks</li></ul><h3 id="SecurityAdvisories-2016">2016</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2016-8739.txt.asc?version=1&modificationDate=1482164360000&api=v2" data-linked-resource-id="67635454" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2016-8739.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2016-8739</a>: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE</li><li><a shape="rect" href="security-advisories.data/CVE-2016-6812.txt.asc?version=1&modificationDate=1482164360000&api=v2" data-linked-resource-id="67635455" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2016-6812.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2016-6812</a>: XSS risk in Apache CXF FormattedServiceListWriter when a request URL contains matrix parameters</li><li><a shape="rect" href="security-advisories.data/CVE-2016-4464.txt.asc?version=1&modificationDate=1473350153000&api=v2" data-linked-resource-id="65869472" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2016-4464.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-contai ner-id="27837502" data-linked-resource-container-version="77">CVE-2016-4464</a>: Apache CXF Fediz application plugins do not match the SAML AudienceRestriction values against the list of configured audience URIs</li></ul><h3 id="SecurityAdvisories-2015">2015</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2015-5253.txt.asc?version=1&modificationDate=1447433340000&api=v2" data-linked-resource-id="61328642" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2015-5253.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2015-5253</a>: Apache CXF SAML SSO processing is vulnerable to a wrapping attack</li><li><a shape="rect" href="security-advisories.data/CVE-2015-5175.txt.asc?version=1&modificationDate=1440598018000&api=v2" data-linked-resource-id="61316328" data-linked-resou rce-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2015-5175.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2015-5175</a>: Apache CXF Fediz application plugins are vulnerable to Denial of Service (DoS) attacks</li></ul><h3 id="SecurityAdvisories-2014">2014</h3><ul><li><a shape="rect" href="security-advisories.data/CVE-2014-3577.txt.asc?version=1&modificationDate=1419245371000&api=v2" data-linked-resource-id="51183657" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3577.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-3577</a>: Apache CXF SSL hostname verification bypass</li><li><a shape="rect" href="securit y-advisories.data/CVE-2014-3566.txt.asc?version=1&modificationDate=1418740474000&api=v2" data-linked-resource-id="50561078" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3566.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">Note on CVE-2014-3566</a>: SSL 3.0 support in Apache CXF, aka the "POODLE" attack.</li><li><a shape="rect" href="security-advisories.data/CVE-2014-3623.txt.asc?version=1&modificationDate=1414169368000&api=v2" data-linked-resource-id="47743195" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3623.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-3623</a>: Apache CXF does not properly enforce the security semantics of SAML SubjectConfirmation methods when used with the TransportBinding</li><li><a shape="rect" href="security-advisories.data/CVE-2014-3584.txt.asc?version=1&modificationDate=1414169326000&api=v2" data-linked-resource-id="47743194" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-3584.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-3584</a>: Apache CXF JAX-RS SAML handling is vulnerable to a Denial of Service (DoS) attack</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370000&api=v2" data-linked-resource-id="40895138" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0109.txt.asc" data-ni ce-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-0109</a>: HTML content posted to SOAP endpoint could cause OOM errors</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378000&api=v2" data-linked-resource-id="40895139" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0110.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-0110</a>: Large invalid content could cause temporary space to fill</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0034.txt.asc?version=1&modificationDate=1398873385000&api=v2" data-linked-resource-id="40895140" data-linked-resource-version="1" data-linked-resource -type="attachment" data-linked-resource-default-alias="CVE-2014-0034.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-0034</a>: The SecurityTokenService accepts certain invalid SAML Tokens as valid</li><li><a shape="rect" href="security-advisories.data/CVE-2014-0035.txt.asc?version=1&modificationDate=1398873391000&api=v2" data-linked-resource-id="40895141" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2014-0035.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2014-0035</a>: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy</li></ul><h3 id="SecurityAdvisories-2013">2013</h3><ul><li><a shape="rect" href="security-advisories.da ta/CVE-2013-2160.txt.asc?version=1&modificationDate=1372324301000&api=v2" data-linked-resource-id="33095710" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="CVE-2013-2160.txt.asc" data-nice-type="Text File" data-linked-resource-content-type="text/plain" data-linked-resource-container-id="27837502" data-linked-resource-container-version="77">CVE-2013-2160</a> - Denial of Service Attacks on Apache CXF</li><li><a shape="rect" href="cve-2012-5575.html">Note on CVE-2012-5575</a> - XML Encryption backwards compatibility attack on Apache CXF.</li><li><a shape="rect" href="cve-2013-0239.html">CVE-2013-0239</a> - Authentication bypass in the case of WS-SecurityPolicy enabled plaintext UsernameTokens.</li></ul><h3 id="SecurityAdvisories-2012">2012</h3><ul><li><a shape="rect" href="cve-2012-5633.html">CVE-2012-5633</a> - WSS4JInInterceptor always allows HTTP Get requests from browser.</li><li><a shape="rect" href="note-on-cve- 2011-2487.html">Note on CVE-2011-2487</a> - Bleichenbacher attack against distributed symmetric key in WS-Security.</li><li><a shape="rect" href="cve-2012-3451.html">CVE-2012-3451</a> - Apache CXF is vulnerable to SOAP Action spoofing attacks on Document Literal web services.</li><li><a shape="rect" href="cve-2012-2379.html">CVE-2012-2379</a> - Apache CXF does not verify that elements were signed or encrypted by a particular Supporting Token.</li><li><a shape="rect" href="cve-2012-2378.html">CVE-2012-2378</a> - Apache CXF does not pick up some child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on the client side.</li><li><a shape="rect" href="note-on-cve-2011-1096.html">Note on CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding attack.</li><li><a shape="rect" href="cve-2012-0803.html">CVE-2012-0803</a> - Apache CXF does not validate UsernameToken policies correctly.</li></ul><h3 id="SecurityAdvisories-2010">2010</h3><ul><li><a shape="rect" cl ass="external-link" href="http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf";>CVE-2010-2076</a> - DTD based XML attacks.</li></ul><p><br clear="none"></p></div> </div> <!-- Content --> </td>
