Security Bulletin: Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1

Summary Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1 Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. Howeve...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +471 more potentially affected by CVE-2026-57819 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =4.0.0, =1.0.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 - com.codbex.kronos:codbex-kronos-components-api-parent 2.69.0 - com.codbex.kronos:codbex-kronos-components-engine-xsjob 2.69.0 -...

com.github.skjolber.xml-log-filter:xml-log-filter-jax-rs (2.0.1), com.norconex.crawler:nx-crawler-core (>=4.0.0-beta.1, <=4.0.0-beta.2) +161 more potentially affected by CVE-2026-57819 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =4.2.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =0.168, =10.0.2, =1.5.0, =1.5.0, =1.5.0, =1.7.0 and more Source cves: CVE-2026-57819 Source advisory: MEND:CVE-2026-57819...

org.apache.camel:camel-cxf (2.0-m1), org.apache.camel:camel-example-cxf (2.0-m1) +21 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.1.4)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.camel:camel-cxf 2.0-m1 - org.apache.camel:camel-example-cxf 2.0-m1 -...

org.apache.cxf.systests:cxf-systests-databinding (2.5.9), org.apache.cxf.systests:cxf-systests-jaxrs (2.5.9) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.5.9)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.5.9 -...

org.apache.cxf.systests:cxf-systests-databinding (2.5.10), org.apache.cxf.systests:cxf-systests-jaxrs (2.5.10) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.5.10)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.5.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.5.10 -...

org.apache.cxf:cxf-anttasks (2.1.3), org.apache.cxf:cxf-eclipse-plugin (2.1.3) +5 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.1.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf:cxf-anttasks 2.1.3 - org.apache.cxf:cxf-eclipse-plugin 2.1.3 -...

org.apache.cxf.systests:cxf-systests-databinding (2.2.7), org.apache.cxf.systests:cxf-systests-jaxrs (2.2.7) +8 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.2.7)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.2.7 -...

org.apache.camel:camel-cxf (2.0-m1), org.apache.camel:camel-example-cxf (2.0-m1) +10 more potentially affected by CVE-2010-2076 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1, <=2.1.9)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =2.1.7, =2.1.7, =2.1.7, =2.1.7, =2.1, =2.1, =2.1, =2.1.6 Source cves: CVE-2010-2076 Source advisory: GHSA-V8Q2-94F6-6XQ2...

org.apache.camel:camel-cxf (2.0-m1), org.apache.camel:camel-example-cxf (2.0-m1) +10 more potentially affected by CVE-2010-2076 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1, <=2.1.9)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =2.1.7, =2.1.7, =2.1.7, =2.1.7, =2.1, =2.1, =2.1, =2.1.6 Source cves: CVE-2010-2076 Source advisory: OSV:GHSA-V8Q2-94F6-6XQ2...

com.custardsource.parfait:parfait-cxf (>=0.2.0, <=0.3.9), com.redhat.rhevm.api:rhevm-api-cli-actions (>=0.9-milestone1, <=0.9-milestone6.6) +55 more potentially affected by CVE-2010-2076 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.2, <=2.2.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.2, =0.2.0, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.1-milestone, =0.9-milestone6....

com.custardsource.parfait:parfait-cxf (>=0.2.0, <=0.3.9), com.redhat.rhevm.api:rhevm-api-cli-actions (>=0.9-milestone1, <=0.9-milestone6.6) +55 more potentially affected by CVE-2010-2076 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.2, <=2.2.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.2, =0.2.0, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.1-milestone, =0.9-milestone6....

com.sap.odata:com.sap.core.odata.core (>=0.4.0, <=0.5.0), com.sap.odata:com.sap.core.odata.processor.core (>=0.4.1, <=0.5.0) +96 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0, <=2.7.3)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =1.4.0, =1.4.0, =2.7.0, =2.7.0, =2.7.0, =2.7.3 and more Source cves: CVE-2013-2160 Source advisory: OSV:GHSA-254Q-RP36-V2M8...

ai.mattmann.mnemosyne:pcs-services (1.11.0), ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23) +130 more potentially affected by CVE-2014-3584 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.5.0, <=2.6.10)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.5.0, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5.1 - com.cloudcontrolled:cctrl-api-client 0.1 - com.cloudcontrolled:cctrl-maven-plugin 0.1 - com.dictanova.gora.gradle:gora-gradle-plugin 0.6 and more Source cves: CVE-2014-3584 Source...

com.github.nicholasastuart:mule-mmc-rest-plugin (1.2.0), com.kagurabi.services:example-authrest (>=1.5, <=1.9.3) +206 more potentially affected by CVE-2014-3584 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0, <=2.7.7)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =1.5, =1.5, =1.5, =1.5, =0.2.0, =0.2.0, =0.4.0, =0.4.1, =ec2-2013-02-01, =1.3.1, =1.2.3, =1.2.5 and more Source cves: CVE-2014-3584 Source advisory: GHSA-GW5J-77F9-V2G2...

ai.mattmann.mnemosyne:pcs-services (1.11.0), ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23) +130 more potentially affected by CVE-2014-3584 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.5.0, <=2.6.10)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.5.0, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5.1 - com.cloudcontrolled:cctrl-api-client 0.1 - com.cloudcontrolled:cctrl-maven-plugin 0.1 - com.dictanova.gora.gradle:gora-gradle-plugin 0.6 and more Source cves: CVE-2014-3584 Source...

ai.mattmann.mnemosyne:pcs-services (1.11.0), com.apitrary:apitrary-api-client (0.1) +84 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.6.0, <=2.6.5)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.6.0, =1.0.3, =1.0.m1, =1.0.m1, =1.0.m2, =1.0.0, =1.0.0, =1.0.0, =0.3.0, =0.3.2 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

com.sap.odata:com.sap.core.odata.core (>=0.4.0, <=0.5.0), com.sap.odata:com.sap.core.odata.processor.core (>=0.4.1, <=0.5.0) +62 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0, <=2.7.2)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =0.4.0, =0.4.1, =1.4.0, =1.4.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.2 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), com.argonio.gora:gora-accumulo (>=0.5, <=0.5.1) +148 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1, <=2.5.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =4.0.0, =0.2.0, =1.0.2, =1.0.0-beta-1, =1.0.0 - com.meschbach.psi:salutator 2.4 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

ai.platon.pulsar:pulsar-persist (>=1.9.0, <=1.10.23), com.argonio.gora:gora-accumulo (>=0.5, <=0.5.1) +148 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1, <=2.5.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =4.0.0, =0.2.0, =1.0.2, =1.0.0-beta-1, =1.0.0 - com.meschbach.psi:salutator 2.4 and more Source cves: CVE-2013-0239 Source advisory: GHSA-P5C5-6564-VVR8...