CVE-2026-85257

CVE-2026-85257 — camel-cxf: SOAP fault information disclosure Runnable proof-of-concept reproducer for the Apache Camel vulnerability where, when a route behind a CXF SOAP consumer failed with an exception the service contract does not declare , the exception was described back to the SOAP client...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

CVE-2024-28752

Apache CXF CVE-2024-28752 Reproduction Environment Vulnerability Advisory: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Environment Startup samples/javafirstjaxwsfactorybean IDEA Start the webservice service via ServerStarter.java Build Use JDK8 mvn clean package java -jar...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

asf__cxf_CVE-2019-17573_3-2-11

Welcome to Apache CXF! Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of...

CVE-2022-46364-htb-ctf

DevArea SOAP Exploitation Tool CVE-2022-46364 Description This specialized exploit targets the DevArea environment on Hack The Box. It leverages a critical vulnerability in Apache CXF 3.2.14 CVE-2022-46364 to perform Local File Inclusion LFI and Server-Side Request Forgery SSRF. The script abuses...

asf__cxf_CVE-2016-6812_3-0-11

Welcome to Apache CXF! Apache CXF is an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. These services can speak a variety of protocols such as SOAP, XML/HTTP, RESTful HTTP, or CORBA and work over a variety of...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...

CVE-2026-46592

CVE-2026-46592 — camel-cxf operationName Header Injection SOAP Operation Redirection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Backend SOAP service ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot...

CLEANSTART-2026-VE39696 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Security vulnerability affects the wildfly package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent toke...

CLEANSTART-2026-IM33662 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays

Security vulnerability affects the wildfly package. Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof-of-Concept exploit for CVE-2022-46364 — an Apache CXF server-side request forgery SSRF vulnerability in MTOM/XOP request processing. Vulnerability Summary CVE-2022-46364 affects Apache CXF versions before 3.4.10 and 3.5.5. When MTOM Messag...

Security Bulletin: Multiple Security Vulnerabilities in Apache CXF affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-68079 DESCRIPTION: In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (October 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-88031 DESCRIPTION: Improper neutralization of special elements in data...

Decompression Bomb

Apache CXF is vulnerable to a decompression bomb. The vulnerability is due to CompressionUtils.inflate decompressing attacker-controlled DEFLATE data without an output-size limit, where a small KB crafted payload can expand to gigabytes on the heap and attackers can trigger it via JWE decryption...

Denial Of Service

Apache CXF is vulnerable to XML Denial of Service. The vulnerability is due to unbounded XML parsing limits, where StaxUtils places no limit on the total number of elements or characters in an XML document and a very large request can consume excessive memory and CPU, allowing attackers to cause ...

CVE-2026-85257

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, t...

EUVD-2026-104195

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, t...

CVE-2026-85257

The Apache Camel CXF component is vulnerable to information disclosure when a route behind a CXF SOAP consumer fails with an undeclared exception. The component may copy the exception message into the SOAP faultstring and include stack traces in the fault detail, potentially revealing internal de...

CVE-2026-85257 Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, t...