Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the DispatchMDBMessageListenerImpl method. An attacker can achieve arbitrary code execution by providing crafted values in the JCA deployment descriptor ra.xml or runtime activation...

CVE-2026-50633 Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

CVE-2026-50633

A JNDI Injection vulnerability exists in the Apache CXF JCA integration module, specifically within DispatchMDBMessageListenerImpl . An attacker who can manipulate the JCA deployment descriptor (ra.xml ) or runtime activation parameters can achieve code execution . To mitigate this risk, users ar...