Apache CXF < 3.6.11 / 4.0.x < 4.1.6 / 4.2.x < 4.2.1 Multiple Vulnerabilities

The version of Apache CXF installed on the remote host is affected by multiple vulnerabilities: - The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted use...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=3.0.0, <=3.6.10) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=3.0.0, <=3.6.10)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =3.0.0, =3.0.0, =3.6.10 Source cves: CVE-2026-44930 Source advisory: OSV:GHSA-PG32-686Q-QH6X...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=3.0.0, <=3.6.10) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=3.0.0, <=3.6.10)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =3.0.0, =3.0.0, =3.6.10 Source cves: CVE-2026-44930 Source advisory: GHSA-PG32-686Q-QH6X...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=4.1.0, <=4.1.5) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=4.1.0, <=4.1.5)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =4.1.0, =4.1.0, =4.1.5 Source cves: CVE-2026-44930 Source advisory: OSV:GHSA-PG32-686Q-QH6X...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=4.1.0, <=4.1.5) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=4.1.0, <=4.1.5)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =4.1.0, =4.1.0, =4.1.5 Source cves: CVE-2026-44930 Source advisory: GHSA-PG32-686Q-QH6X...

org.apache.cxf.services.xkms:cxf-services-xkms-war (4.2.0) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (4.2.0)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap and may be impacted: -...

org.apache.cxf.services.xkms:cxf-services-xkms-war (4.2.0) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (4.2.0)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap and may be impacted: -...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection via the LdapCertificateRepo of the XKMS server. An attacker can retrieve arbitrary certificates from the repository by injecting crafted LDAP queries. Remediation Upgrade...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=3.0.0, <=3.6.10) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=3.0.0, <=3.6.10)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =3.0.0, =3.0.0, =3.6.10 Source cves: CVE-2026-44930 Source advisory: SNYK:JAVA-ORGAPACHECXFSERVICESXKMS-16874169...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=4.0.0, <=4.1.5) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=4.0.0, <=4.1.5)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =4.0.0, =4.0.0, =4.1.5 Source cves: CVE-2026-44930 Source advisory: SNYK:JAVA-ORGAPACHECXFSERVICESXKMS-16874169...

org.apache.cxf.services.xkms:cxf-services-xkms-war (4.2.0) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (4.2.0)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap and may be impacted: -...

CVE-2026-44930

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44930 Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

EUVD-2026-31433

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44930

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44930 Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44930

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=3.0.0, <=3.6.10) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=3.0.0, <=3.6.10)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =3.0.0, =3.0.0, =3.6.10 Source cves: CVE-2026-44930 Source advisory: MEND:CVE-2026-44930...

org.apache.cxf.services.xkms:cxf-services-xkms-war (>=4.0.0, <=4.1.5) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (>=4.0.0, <=4.1.5)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version =4.0.0, =4.0.0, =4.1.5 Source cves: CVE-2026-44930 Source advisory: MEND:CVE-2026-44930...

org.apache.cxf.services.xkms:cxf-services-xkms-war (4.2.0) potentially affected by CVE-2026-44930 via org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (4.2.0)

org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap and may be impacted: -...