XML External Entity

Apache CXF is vulnerable to XML External Entity attacks. The vulnerability is due to the use of WSDL4J for processing imported or documents without disabling DOCTYPE declarations or external entities, where the hardened StaxUtils path only protects the top‑level WSDL and does not extend to these...

CLEANSTART-2026-DL82237 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities

Security vulnerability affects the wildfly package. Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities...

CVE-2026-65432 Apache CXF: XXE via WSDL/XSD import parsing

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

CVE-2026-65432: Improper Restriction of XML External Entity Reference

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...