CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

CVE-2026-86463 Apache CXF: FIQL Query Parser Denial of Service

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

EUVD-2026-95698

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

CVE-2026-86463

The Apache CXF FIQL query parser contains a vulnerability where the search pattern for operators can become stuck when processing long strings without an operator. This flaw causes the parser to consume excessive CPU time , potentially leading to a Denial of Service (DoS) or significant performan...

io.github.aafc-bicoe:dina-base-api (>=0.168, <=0.182), net.tirasa.connid.bundles:net.tirasa.connid.bundles.rest (1.1.2) +7 more potentially affected by CVE-2026-86463 via org.apache.cxf:cxf-rt-rs-extension-search (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-rs-extension-search MAVEN version =4.2.0, =0.168, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =8.0.0-rc2, =8.1.0-rc2 Source cves: CVE-2026-86463 Source advisory: MEND:CVE-2026-86463...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-21933 DESCRIPTION: Java SE could allow a remote attacker to bypass security controls and perform unauthorized update, insert, delete, or read operations on...

CVE-2026-79650

The Apache CXF OIDC relying-party component is vulnerable to an open redirect (CWE-601) where users can be redirected to an attacker-controlled URL after successful authentication. The root cause is that attacker-controlled state parameters are preserved and used as redirect targets without verif...

CVE-2026-79650 Apache CXF: OIDC RP Open Redirect

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the...

org.apache.cxf.systests:cxf-systests-rs-security (>=4.2.0, <=4.2.3), org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-79650 via org.apache.cxf:cxf-rt-rs-security-sso-oidc (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-rs-security-sso-oidc MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-79650 Source advisory: MEND:CVE-2026-79650...

EUVD-2026-95697

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the...

CVE-2026-78384 Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

CVE-2026-78384

A vulnerability exists in Apache CXF (specifically the org.apache.cxf:cxf-core component) where the CompressionUtils.inflate() function fails to enforce an output-size cap when decompressing DEFLATE data. A remote attacker can exploit this by submitting a small, crafted payload that expands into ...

EUVD-2026-95696

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

CVE-2026-73179

The Apache CXF JPA OAuth2 authorization code grant provider is vulnerable to a race condition due to non-atomic find-then-delete operations on a shared relational database under READ_COMMITTED isolation. A remote attacker can exploit this to obtain multiple valid access tokens from a single autho...

EUVD-2026-95695

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

CVE-2026-73179

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-73179 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.8 and more Source cves: CVE-2026-73179 Source advisory: MEND:CVE-2026-73179...

CVE-2026-73179 Apache CXF: JPA authorization-code consume is non-atomic

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

org.apache.cxf.systests:cxf-systests-rs-security (>=4.2.0, <=4.2.3), org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-71575 via org.apache.cxf:cxf-rt-rs-security-sso-oidc (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-rs-security-sso-oidc MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-71575 Source advisory: MEND:CVE-2026-71575...

CVE-2026-71575

The Apache CXF framework is vulnerable in the OidcClientCodeRequestFilter component due to an inoperative max_age authentication-freshness check. The root cause is a unit mismatch between milliseconds and seconds combined with an inverted comparison polarity . This flaw allows relying parties usi...