[
https://issues.apache.org/jira/browse/TOMEE-4622?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla closed TOMEE-4622.
----------------------------------
Assignee: Richard Zowalla
Resolution: Fixed
> Upgrade CXF to 4.1.7
> --------------------
>
> Key: TOMEE-4622
> URL: https://issues.apache.org/jira/browse/TOMEE-4622
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Reporter: RAJU THANNEERU
> Assignee: Richard Zowalla
> Priority: Major
> Fix For: 10.1.6
>
>
> We see few criticals and highs on CXF 4.1.6 and we have 4.1.7 with fixes.
> |[CVE-2026-49875|https://nvd.nist.gov/vuln/detail/CVE-2026-49875]|9.8|critical|fixed
> in 4.2.2, 4.1.7|2026-06-15 22:32:37 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50623|https://nvd.nist.gov/vuln/detail/CVE-2026-50623]|4.8|medium|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50627|https://nvd.nist.gov/vuln/detail/CVE-2026-50627]|9.1|critical|fixed
> in 4.2.2, 4.1.7|2026-06-15 22:32:37 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50628|https://nvd.nist.gov/vuln/detail/CVE-2026-50628]|9.8|critical|fixed
> in 4.2.2, 4.1.7|2026-06-15 22:32:37 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50629|https://nvd.nist.gov/vuln/detail/CVE-2026-50629]|5.3|medium|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50630|https://nvd.nist.gov/vuln/detail/CVE-2026-50630]|6.5|medium|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50631|https://nvd.nist.gov/vuln/detail/CVE-2026-50631]|7.4|high|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50632|https://nvd.nist.gov/vuln/detail/CVE-2026-50632]|8.1|high|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50633|https://nvd.nist.gov/vuln/detail/CVE-2026-50633]|8.1|high|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50634|https://nvd.nist.gov/vuln/detail/CVE-2026-50634]|6.5|medium|fixed
> in 4.2.2, 4.1.7|2026-06-13 00:53:02 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
> |[CVE-2026-50645|https://nvd.nist.gov/vuln/detail/CVE-2026-50645]|7.5|high|fixed
> in 4.2.2, 4.1.7|2026-06-13 07:38:38 +0000
> UTC|/usr/local/tomee/lib/cxf-core-4.1.6.jar|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
