CVE-2016-6812

CVE-2016-6812 affects the HTTP transport module of Apache CXF. The issue arises when the service list page is generated using the calculated base URL; if the request URL contains unexpected matrix parameters, they may be echoed back in the service endpoint URLs, causing a reflected cross‑site scr...

CVE-2026-57819

CVE-2026-57819 affects Apache CXF; there is no default limit on the number of form parameters per JAX-RS message due to the maxFormParameterCount setting. This can enable denial-of-service when processing requests with many form parameters. The connected sources state fixes by introducing a defau...

CVE-2013-0239

CVE-2013-0239 affects Apache CXF: versions before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3. When plaintext UsernameToken WS-SecurityPolicy is enabled, a security header containing a UsernameToken element with no password can bypass authentication. This is an authentication bypass vulnera...

CVE-2026-65432

Apache CXF is affected by an XXE in WSDL/XSD import parsing. The hardened StaxUtils path disables DTDs and external entities only for the top-level WSDL, but imported documents (wsdl:import /xsd:import ) are handed to WSDL4J, which does not disable DOCTYPE declarations or external entities, so im...

CVE-2014-3584

The vulnerability CVE-2014-3584 affects Apache CXF’s SamlHeaderInHandler. In CXF versions before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1, a crafted SAML token in the authorization header to a JAX-RS service can trigger an infinite loop, causing a denial of service. Remediation is to up...

CVE-2026-50628

CVE-2026-50628 concerns Apache CXF’s OAuthRequestFilter, where a logic error creates an inverted IP binding check: legitimate requests from the bound IP are rejected while requests from other IPs are allowed. Red Hat’s advisory attributes this to the OAuthRequestFilter component of CXF and notes ...

CVE-2014-0109

CVE-2014-0109 (Apache CXF) affects CXF before 2.6.14 and 2.7.x before 2.7.11. The vulnerability allows a remote attacker to trigger a denial of service (memory exhaustion) by sending a large request with Content-Type: text/html to a SOAP endpoint, which triggers an error. The provided connected s...

CVE-2026-44618

Technical details for CVE-2026-44618 are not publicly available in the provided documents. The records mention an XXE vulnerability in Apache CXF WS-Transfer and upgrade versions, but no further specifics are provided. Monitor for updates.

CVE-2014-0035

The CVE-2014-0035 issue affects Apache CXF, specifically SymmetricBinding when EncryptBeforeSigning is enabled and UsernameToken policy is EncryptedSupportingToken. The vulnerability causes the UsernameToken to be transmitted in cleartext, enabling an attacker to sniff sensitive information over ...

CVE-2026-50631

CVE-2026-50631 : A TOCTOU race condition in Apache CXF's AbstractOAuthDataProvider allows concurrent requests to reuse the same Refresh Token when recycleRefreshTokens is false, bypassing single-use semantics and generating multiple valid Access Tokens. This can enable token replay/abuse by multi...

CVE-2026-57818

The vulnerability CVE-2026-57818 affects the JCacheCodeDataProvider used in Apache CXF’s OAuth2 implementation. A TOCTOU race condition allows an attacker to redeem a single authorization code multiple times through concurrent requests, causing issuance of multiple distinct, valid access tokens. ...

CVE-2012-0803

Apache CXF CVE-2012-0803 affects CXF 2.4.5 and 2.5.1 where WS-SP UsernameToken policy validation against the security header UsernameToken is broken, allowing a malicious client to bypass authentication by sending an empty UsernameToken in a SOAP request. The issue arises from CXF not validating ...

CVE-2014-0110

The CVE-2014-0110 entry concerns Apache CXF (affected versions: before 2.6.14 and 2.7.x before 2.7.11) where processing a large invalid SOAP message can cause a denial of service by exhausting temporary disk space. The issue is documented across multiple sources (including GHSA and OSV entries) a...

CVE-2026-68481

CVE-2026-68481 affects Apache CXF’s DefaultEncryptingOAuthDataProvider. Revoked access and refresh tokens can still be decrypted, and TokenIntrospectionService reports active:true, contrary to RFC expectations that revoked tokens be invalidated and introspection return {"active":false}. The issue...

CVE-2026-63687

Apache CXF JwtRequestCodeFilter exposes PKCE and OIDC replay protections by copying all claims from a signed request JWT into the authorization parameter map without excluding sensitive parameters. A adversary who can produce a validly-signed JWT (e.g., with a known/compromised client_secret) can...

CVE-2026-50623

CVE-2026-50623 affects Apache CXF’s OAuth2 TokenIntrospectionService. A missing 'throw' in the security context check permits access to the introspection endpoint (/services/oauth2/introspect) by any unauthenticated network attacker. This bypass is tied to a safeguard condition when authenticatio...

CVE-2026-50629

The CVE-2026-50629 issue affects Apache CXF’s OAuth2 server where the 'clientId' from HTTP requests is concatenated into log warning messages without sanitizing control characters. This creates log injection risk by allowing arbitrary content in logs. Root cause: unsanitized control characters in...

CVE-2026-50630

The CVE-2026-50630 issue affects Apache CXF’s OAuth2 implementation, where the AuthorizationUtils class concatenates the realm parameter into the WWW-Authenticate header without sanitizing CR/LF characters. This can enable header injection or HTTP response splitting if an attacker controls the re...

CVE-2012-5786

Apache CXF’s wsdl_first_https sample in versions before 2.7.0 fails to verify server hostname against the certificate’s CN/subjectAltName, enabling MITM spoofing with an arbitrary valid certificate. This is tied to the sample’s DN check bypass flag. Publicly documented impact is limited to the sa...