CVE-2026-54342 TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

CVE-2026-54342

The CVE affects epa4all prior to 2026-05-20, where TLS certificate verification is disabled on CXF transport clients. A network attacker can intercept connections between epa4all and backends (ePA Aktensystem, Konnektor, IDP, TSS) by presenting a self-signed certificate. For non-VAU backends (Kon...

The vulnerabilities of the components camel-knative-http, camel-cxf-rest, and camel-cxf-transport from the Apache Camel framework allow attackers to execute arbitrary code or gain unauthorized access during write operations.

The vulnerability of the camel-knative-http, camel-cxf-rest, and camel-cxf-transport components of the Apache Camel framework is related to deficiencies in the mechanism for processing registry-dependent data. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain...

Improper Validation of Unsafe Equivalence in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the CXF-RS or CXF-SOAP endpoints due to missing inbound filtering via setInFilterStartsWith. An attacker can execute arbitrary code and write files by injecting Camel-internal header...

de.ikor.sip.foundation:sip-integration-starter (>=2.4.0 <=3.2.0), de.ikor.sip.foundation:sip-soap-starter (>=3.0.0 <=3.2.0) +45 more potentially affected by CVE-2026-47323 via org.apache.camel:camel-cxf-transport (>=3.18.0 <=4.14.5)

org.apache.camel:camel-cxf-transport MAVEN version =3.18.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.0.1, =2.0.1, =4.0.0.Beta1, =4.0.0.Beta1, =4.1.3, =4.0.0.Beta1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =0.1.0, =4.14.5 and more Source cves: CVE-2026-47323 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16787112...

Remote Code Execution (RCE)

org.apache.cxf:cxf-rt-transports-jms is vulnerable to Remote Code Execution RCE. The vulnerability is due to allowing untrusted users to configure JMS with RMI or LDAP URLs, which could be abused for code execution...

com.treelogic-swe:aws-mock (=1.0), com.treelogic-swe:cxf-stub (=ec2-2013-02-01) +53 more potentially affected by CVE-2025-48913 via org.apache.cxf:cxf-rt-transports-jms (>=2.0.6 <=3.6.7)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =2.0.6, =1.4.0, =1.4.0, =3.0.0, =2.2.7, =2.4.0, =2.1.7, =2.1.7, =2.3.0, =2.0.6, =2.6.0, =2.0.6, =2.0.6, =3.2.0, =3.6.11 and more Source cves: CVE-2025-48913 Source advisory: OSV:GHSA-G4PX-6QHM-HQJM...

com.axonivy.ivy.tool.soap:cxf-client-codegen (=1.0.0), cv.igrp:igrp-core (>=1.7.3.230801 <=1.7.3.230802) +294 more potentially affected by CVE-2024-41172 via org.apache.cxf:cxf-rt-transports-http (>=3.6.0 <=3.6.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =3.6.0, =1.7.3.230801, =3.0-M3, =3.0-M3, =3.0-M3, =4.4.6.hyte-24270, =4.4.6.hyte-24270, =4.4.6.hyte-24270, =4.4.8.hyte-26150 - io.hyte.platform:repo =4.4.6.hyte-24270 - net.tirasa.connid.bundles:net.tirasa.connid.bundles.servicenow =1.0.4 -...

be.atbash.test:integration-testing (=2.2.0), be.atbash.test:integration-testing-database (=2.2.0) +511 more potentially affected by CVE-2024-41172 via org.apache.cxf:cxf-rt-transports-http (>=4.0.0 <=4.0.4)

org.apache.cxf:cxf-rt-transports-http MAVEN version =4.0.0, =1.0.0, =12.1-16, =0.0.1, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons =2.70.0 - com.codbex.kronos:codbex-kronos-components-api-parent =2.69.0 - com.codbex.kronos:codbex-kronos-components-engine-xsjob =2.69.0 -...

com.alibaba:dubbo (>=2.3.0 <=2.5.3), com.apitrary:apitrary-api-client (=0.1) +163 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.6.0 <=2.6.6)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.6.0, =2.3.0, =0.0.2, =1.0.0, =1.0.0, =1.0.3, =1.0.M1, =1.0.M1, =1.0.M2, =1.0.0, =1.2.0 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...