93676 matches found
CVE-2026-107937 Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...
CVE-2026-100227 Apache CXF: XML Signature wrapping in JAX-RS XML Security
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...
EUVD-2026-95701
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...
CVE-2026-100227
Apache CXF's JAX-RS XML Security module contains an Improper Verification of Cryptographic Signature vulnerability. Specifically, the JAX-RS XML Signature interceptors (XmlSigInHandler , XmlSigInInterceptor , and the streaming XmlSecInInterceptor ) fail to verify that the XML passed to the applic...
CVE-2026-100227
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...
CVE-2026-100227 Apache CXF: XML Signature wrapping in JAX-RS XML Security
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...
CVE-2026-100227 Apache CXF: XML Signature wrapping in JAX-RS XML Security
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...
org.apache.cxf.systests:cxf-systests-rs-security (>=4.0.0, <=4.1.8), org.apache.cxf:apache-cxf (>=4.0.0, <=4.1.8) +4 more potentially affected by CVE-2026-100227 via org.apache.cxf:cxf-rt-rs-security-xml (>=4.0.0, <=4.1.8)
org.apache.cxf:cxf-rt-rs-security-xml MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.8 Source cves: CVE-2026-100227 Source advisory: MEND:CVE-2026-100227...
org.apache.cxf.systests:cxf-systests-rs-security (>=4.2.0, <=4.2.3), org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3) +4 more potentially affected by CVE-2026-100227 via org.apache.cxf:cxf-rt-rs-security-xml (>=4.2.0, <=4.2.3)
org.apache.cxf:cxf-rt-rs-security-xml MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-100227 Source advisory: MEND:CVE-2026-100227...
CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
EUVD-2026-95700
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97791
A flaw in Apache CXF 's STSTokenValidator allows for an authentication bypass during SAML token validation. The vulnerability stems from a race condition (CWE-362) where the validator shares a single object to store validation results across concurrent requests. This allows a remote, unauthentica...
CVE-2026-97468
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
CVE-2026-97468
Apache CXF 's STSTokenValidator and Security Token Service (STS) are vulnerable to an authentication bypass because they cache validated security tokens using a weak, non-cryptographic 32-bit hash (Java Arrays.hashCode/hashCode() ). A remote attacker can craft a security token, such as a Username...
EUVD-2026-95699
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...
CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...