org.apache.cxf.systests:cxf-systests-jaxrs (>=4.1.0, <=4.1.5), org.apache.cxf.systests:cxf-systests-transport-jms (>=4.1.0, <=4.1.5) +13 more potentially affected by CVE-2025-48913 +1 more via org.apache.cxf:cxf-rt-transports-jms (>=4.1.0, <=4.1.5)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta3 - org.ow2.petals.samples.soap:cxf-server 5.2.0-1.0.0 -...

Apache CXF: Untrusted JMS configuration can lead to RCE

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1...

org.apache.cxf.systests:cxf-systests-jaxrs (4.2.0), org.apache.cxf.systests:cxf-systests-transport-jms (4.2.0) +4 more potentially affected by CVE-2025-48913 +1 more via org.apache.cxf:cxf-rt-transports-jms (4.2.0)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 4.2.0 -...

CVE-2026-44417

A vulnerability in Apache CXF allows for Remote Code Execution (RCE) if untrusted users are permitted to configure JMS. This issue stems from an incomplete fix for CVE-2025-48913, where additional code paths remain susceptible to exploitation. The vulnerability affects the cxf-rt-transports-jms c...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.14 (RHSA-2026:6012)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6012 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4915)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4915 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.

Summary IBM Maximo Application Suite uses "org.apache.cxfcxf-core 3.6.7, io.nettynetty-codec-http 4.1.124.Final , github.com/golang-jwt/jwt/v4 v4.5.0" which are vulnerable to "CVE-2025-48913, CVE-2025-58056, CVE-2024-51744". This bulletin contains information regarding the vulnerabilities and how...

Security Bulletin: IBM Guardium Data Protection is affected by a Apache/Tomcat Vulnerabilities related to cxf-core-3.5.10.jar vulnerability (CVE-2025-48913)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-48913 DESCRIPTION: If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilitie...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-48795 CVE-2025-48913)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2025-48795 DESCRIPTION: Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the...

RHEL 8 / 9 : Red Hat JBoss Enterprise Application Platform 8.0.9 (RHSA-2025:17317)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17317 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This...

org.apache.cxf:apache-cxf (2.1.6), org.apache.cxf:cxf-distribution-manifest (2.1.6) +2 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (2.1.6)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf:apache-cxf 2.1.6 - org.apache.cxf:cxf-distribution-manifest 2.1.6 -...

org.apache.camel:camel-example-cxf (>=2.12.5, <=2.13.3), org.apache.cxf.systests:cxf-systests-jaxrs (2.7.13) +7 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (2.7.13)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.7.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.camel:camel-example-cxf =2.12.5, =2.13.3 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.7.15), org.apache.cxf.systests:cxf-systests-transport-jms (2.7.15) +8 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (2.7.15)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.7.15 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.7.16), org.apache.cxf.systests:cxf-systests-transport-jms (2.7.16) +6 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (2.7.16)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.7.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.7.16 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.7.17), org.apache.cxf.systests:cxf-systests-transport-jms (2.7.17) +6 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (2.7.17)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.7.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.7.17 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.7.18), org.apache.cxf.systests:cxf-systests-transport-jms (2.7.18) +8 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (2.7.18)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.7.18 -...

org.apache.camel:camel-example-cxf (>=2.14.0, <=2.19.5), org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests (>=3.0.0, <=3.6.7) +17 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (>=3.0.0-milestone1, <=3.6.7)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =3.0.0-milestone1, =2.14.0, =3.0.0, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.2.0, =5.0.0.beta1, =5.0.0.beta1, =5.0.0.beta1,...

org.apache.cxf.systests:cxf-systests-jaxrs (>=4.0.0, <=4.0.8), org.apache.cxf.systests:cxf-systests-transport-jms (>=4.0.0, <=4.0.8) +18 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (>=4.0.0, <=4.0.8)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =6.2.0.final, =7.0.0.final, =7.0.0.final, =6.2.0.final, =6.2.0.final, =7.0.0.final, =7.0.0.final, =6.2.0.final, =7.0.0.final, =7.3.3.final and more Source cves: CVE-2025-48913 Source advisor...

org.apache.cxf.systests:cxf-systests-jaxrs (>=4.1.0, <=4.1.2), org.apache.cxf.systests:cxf-systests-transport-jms (>=4.1.0, <=4.1.2) +7 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (>=4.1.0, <=4.1.2)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.2 - org.ow2.petals.samples.soap:cxf-server 5.2.0-1.0.0 - org.ow2.petals.samples.soap:cxf-simple-clients 5.2.0-1.0.0 - org.ow2.petals.samples.soap:cxf-wsa-async-client 5.2.0-1.0.0 Source...

org.apache.cxf.systests:cxf-systests-jaxrs (>=4.1.0, <=4.1.2), org.apache.cxf.systests:cxf-systests-transport-jms (>=4.1.0, <=4.1.2) +7 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (>=4.1.0, <=4.1.2)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.2 - org.ow2.petals.samples.soap:cxf-server 5.2.0-1.0.0 - org.ow2.petals.samples.soap:cxf-simple-clients 5.2.0-1.0.0 - org.ow2.petals.samples.soap:cxf-wsa-async-client 5.2.0-1.0.0 Source...