CLEANSTART-2026-VE39696 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Security vulnerability affects the wildfly package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent toke...

CLEANSTART-2026-IM33662 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays

Security vulnerability affects the wildfly package. Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof-of-Concept exploit for CVE-2022-46364 — an Apache CXF server-side request forgery SSRF vulnerability in MTOM/XOP request processing. Vulnerability Summary CVE-2022-46364 affects Apache CXF versions before 3.4.10 and 3.5.5. When MTOM Messag...

CVE-2024-28752

Apache CXF CVE-2024-28752 Reproduction Environment Vulnerability Advisory: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Environment Startup samples/javafirstjaxwsfactorybean IDEA Start the webservice service via ServerStarter.java Build Use JDK8 mvn clean package java -jar...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

asf__cxf_CVE-2016-6812_3-0-11

Welcome to Apache CXF! Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of...

CVE-2022-46364-htb-ctf

DevArea SOAP Exploitation Tool CVE-2022-46364 Description This specialized exploit targets the DevArea environment on Hack The Box. It leverages a critical vulnerability in Apache CXF 3.2.14 CVE-2022-46364 to perform Local File Inclusion LFI and Server-Side Request Forgery SSRF. The script abuses...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...

asf__cxf_CVE-2019-17573_3-2-11

Welcome to Apache CXF! Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of...

Security Bulletin: Multiple Security Vulnerabilities in Apache CXF affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-68079 DESCRIPTION: In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (October 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-88031 DESCRIPTION: Improper neutralization of special elements in data...

Decompression Bomb

Apache CXF is vulnerable to a decompression bomb. The vulnerability is due to CompressionUtils.inflate decompressing attacker-controlled DEFLATE data without an output-size limit, where a small KB crafted payload can expand to gigabytes on the heap and attackers can trigger it via JWE decryption...

Denial Of Service

Apache CXF is vulnerable to XML Denial of Service. The vulnerability is due to unbounded XML parsing limits, where StaxUtils places no limit on the total number of elements or characters in an XML document and a very large request can consume excessive memory and CPU, allowing attackers to cause ...

Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 Multiple Vulnerabilities

The version of Apache CXF installed on the remote host is prior to 3.6.13, or 4.x prior to 4.1.9, or 4.2.x prior to 4.2.4. It is, therefore, affected by multiple vulnerabilities, including: - The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF

Summary IBM WebSphere Application Server Liberty is shipped with IBM Tivoli Netcool Impact as part of its server infrastructure. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Vulnerability Details Refer to...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Author: 0xmid00 Vulnerability: SSRF / Local File Read via XOP:Include in MTOM requests Affected: Apache CXF 3.5.5 and 3.4.10 What is the Vulnerability? Apache CXF processes MTOM Message Transmission Optimization Mechanism messages that contain...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

CVE-2026-108039

A flaw was found in Apache CXF. By default, the XML parsing utility does not enforce limits on the total number of elements or characters within an incoming XML document. A remote attacker could exploit this vulnerability by sending an excessively large XML request, causing the application to...

CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...