no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50630 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339182...

HTTP Response Splitting

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to HTTP Response Splitting via improper handling of the realm parameter in the construction of the WWW-Authenticate response header. An attacker can inject arbitrary HTTP...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +14 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 and more Source cves: CVE-2026-50634 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339189...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +16 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50634 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339189...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50631 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 Source cves: CVE-2026-50631 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339183...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50631 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50631 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339183...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +13 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 Source cves: CVE-2026-50630 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339182...

CVE-2026-50633

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

CVE-2026-50634

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted Content-Type or protected HTTP-header metadata came from a verified...

CVE-2026-50645

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this...

CVE-2026-50632

A further incomplete fix for a previous advisory CVE-2026-44417 Untrusted JMS configuration can lead to RCE for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions...

CVE-2026-49875

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band OOB external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue...

CVE-2026-50623

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint /services/oauth2/introspect can be accessed by any unauthenticated network attacker. However note that th...

CVE-2026-50645 Apache CXF: No restriction on attachment headers per message

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this...

CVE-2026-50645 Apache CXF: No restriction on attachment headers per message

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this...

CVE-2026-50645 Apache CXF: No restriction on attachment headers per message

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this...

EUVD-2026-36403

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by...

CVE-2026-50645

CVE-2026-50645 affects Apache CXF during message deserialization, where there is no restriction on the number of attachment headers. This can enable uncontrolled resource consumption and a denial-of-service condition. The issue is mitigated by limiting attachments per message to a default maximum...

CVE-2026-50634 Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted Content-Type or protected HTTP-header metadata came from a verified...

CVE-2026-50634

CVE-2026-50634 affects Apache CXF's JwsJsonContainerRequestFilter. The vulnerability allows CXF to process metadata that was not authenticated by the accepted signature, bypassing the assumption that Content-Type or protected HTTP-header metadata came from a verified signature. This can influence...