CVE-2026-65432

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any "wsdl:import" wsdl:import or "xsd:import" xsd:import referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or...

PT-2026-68464

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12 Description While the software uses a hardened path to disable XML DTDs and external entities for top-level WSDL files, any or references...