CVE-2026-57818

A Time-of-check Time-of-use (TOCTOU) race condition exists in the JCacheCodeDataProvider component of Apache CXF (specifically within cxf-rt-rs-security-oauth2). This flaw allows a remote attacker to perform an authorization code replay by submitting concurrent requests to redeem a single authori...

CVE-2013-2160

CVE-2013-2160 affects Apache CXF’s streaming XML parser. Versions affected: CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4. A crafted XML payload with a very large number of elements/attributes/nested constructs can cause denial of service through CPU and memory exhaustion. T...

CVE-2016-6812

CVE-2016-6812 affects the HTTP transport module of Apache CXF. The issue arises when the service list page is generated using the calculated base URL; if the request URL contains unexpected matrix parameters, they may be echoed back in the service endpoint URLs, causing a reflected cross‑site scr...

CVE-2015-5253

CVE-2015-5253 affects Apache CXF SAML Web SSO module: remote authenticated bypass via a crafted SAML response with a valid signed assertion, related to a wrapping attack. Affected versions include CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3. The vulnerability can bypass authenti...

CVE-2026-68481

Apache CXF is vulnerable to improper authorization due to a flaw in the DefaultEncryptingOAuthDataProvider process. This issue allows revoked access and refresh tokens to remain valid and be reported as active by the TokenIntrospectionService, bypassing intended revocation processes and potential...

CVE-2010-2076

CVE-2010-2076 affects Apache CXF: versions 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9 used in various projects (ServiceMix, Camel, jUDDI, Geronimo, etc.). The issue is failure to reject DTDs in SOAP messages, enabling an attacker to read arbitrary files, make HTTP requests t...

CVE-2013-0239

CVE-2013-0239 affects Apache CXF: versions before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3. When plaintext UsernameToken WS-SecurityPolicy is enabled, a security header containing a UsernameToken element with no password can bypass authentication. This is an authentication bypass vulnera...

CVE-2026-50631

A race condition in the AbstractOAuthDataProvider of Apache CXF allows concurrent requests using the same Refresh Token to bypass single-use semantics. When the recycleRefreshTokens parameter is set to false , an attacker can replay a leaked refresh token concurrently to generate multiple valid A...

CVE-2026-44618

The Apache CXF framework is vulnerable to XML External Entity (XXE) attacks due to an insecure XML parser configuration in the WS-Transfer module. This flaw allows attackers to process XML input containing external entity references, potentially leading to unauthorized access to internal files or...

CVE-2014-3584

The vulnerability CVE-2014-3584 affects Apache CXF’s SamlHeaderInHandler. In CXF versions before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1, a crafted SAML token in the authorization header to a JAX-RS service can trigger an infinite loop, causing a denial of service. Remediation is to up...

CVE-2014-0109

CVE-2014-0109 (Apache CXF) affects CXF before 2.6.14 and 2.7.x before 2.7.11. The vulnerability allows a remote attacker to trigger a denial of service (memory exhaustion) by sending a large request with Content-Type: text/html to a SOAP endpoint, which triggers an error. The provided connected s...

CVE-2012-0803

Apache CXF CVE-2012-0803 affects CXF 2.4.5 and 2.5.1 where WS-SP UsernameToken policy validation against the security header UsernameToken is broken, allowing a malicious client to bypass authentication by sending an empty UsernameToken in a SOAP request. The issue arises from CXF not validating ...

CVE-2014-0035

The CVE-2014-0035 issue affects Apache CXF, specifically SymmetricBinding when EncryptBeforeSigning is enabled and UsernameToken policy is EncryptedSupportingToken. The vulnerability causes the UsernameToken to be transmitted in cleartext, enabling an attacker to sniff sensitive information over ...

CVE-2014-0110

The CVE-2014-0110 entry concerns Apache CXF (affected versions: before 2.6.14 and 2.7.x before 2.7.11) where processing a large invalid SOAP message can cause a denial of service by exhausting temporary disk space. The issue is documented across multiple sources (including GHSA and OSV entries) a...

CVE-2026-50623

An authentication bypass vulnerability exists in the Apache CXF OAuth2 TokenIntrospectionService component. The root cause is a missing throw keyword during the security context check, which allows an unauthenticated network attacker to access the introspection endpoint at /services/oauth2/intros...

CVE-2026-63687

A security bypass vulnerability exists in Apache CXF within the cxf-rt-rs-security-oauth2 component. The JwtRequestCodeFilter fails to exclude security-sensitive parameters when copying claims from a signed request JWT into the authorization parameter map. An attacker who possesses or compromises...

CVE-2026-50629

The Apache CXF framework is vulnerable to Log Injection (CVE-2026-50629) because the clientId parameter from incoming HTTP requests is concatenated into OAuth2 server log warning messages without sanitizing control characters. This flaw allows an attacker to inject arbitrary content, including fa...

CVE-2026-50630

A CRLF injection vulnerability exists in the Apache CXF OAuth2 AuthorizationUtils class. The root cause is the lack of sanitization for Carriage Return (CR) and Line Feed (LF) characters when the 'realm' parameter is concatenated into the WWW-Authenticate response header. An attacker capable of c...

CVE-2012-5786

Apache CXF’s wsdl_first_https sample in versions before 2.7.0 fails to verify server hostname against the certificate’s CN/subjectAltName, enabling MITM spoofing with an arbitrary valid certificate. This is tied to the sample’s DN check bypass flag. Publicly documented impact is limited to the sa...

CVE-2026-107937

In Apache CXF , the parser for multipart/MTOM attachment part headers fails to fully enforce attachment-max-header-size and attachment-headers-max-count limits. Specifically, size limits are only applied to physical lines rather than continuation lines or repeated headers, and count limits check ...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

CVE-2026-97468

Apache CXF 's STSTokenValidator and Security Token Service (STS) are vulnerable to an authentication bypass because they cache validated security tokens using a weak, non-cryptographic 32-bit hash (Java Arrays.hashCode/hashCode() ). A remote attacker can craft a security token, such as a Username...

CVE-2026-97791

A flaw in Apache CXF 's STSTokenValidator allows for an authentication bypass during SAML token validation. The vulnerability stems from a race condition (CWE-362) where the validator shares a single object to store validation results across concurrent requests. This allows a remote, unauthentica...

CVE-2026-78384

A vulnerability exists in Apache CXF (specifically the org.apache.cxf:cxf-core component) where the CompressionUtils.inflate() function fails to enforce an output-size cap when decompressing DEFLATE data. A remote attacker can exploit this by submitting a small, crafted payload that expands into ...

CVE-2026-108039

The Apache CXF framework contains a vulnerability where StaxUtils fails to enforce limits on the total number of elements or characters in an XML document by default. This flaw allows an attacker to send an excessively large XML request, leading to excessive CPU and memory consumption during pars...

CVE-2026-100227

Apache CXF's JAX-RS XML Security module contains an Improper Verification of Cryptographic Signature vulnerability. Specifically, the JAX-RS XML Signature interceptors (XmlSigInHandler , XmlSigInInterceptor , and the streaming XmlSecInInterceptor ) fail to verify that the XML passed to the applic...

CVE-2026-71575

The Apache CXF framework is vulnerable in the OidcClientCodeRequestFilter component due to an inoperative max_age authentication-freshness check. The root cause is a unit mismatch between milliseconds and seconds combined with an inverted comparison polarity . This flaw allows relying parties usi...

CVE-2026-86463

The Apache CXF FIQL query parser contains a vulnerability where the search pattern for operators can become stuck when processing long strings without an operator. This flaw causes the parser to consume excessive CPU time , potentially leading to a Denial of Service (DoS) or significant performan...

CVE-2026-73179

The Apache CXF JPA OAuth2 authorization code grant provider is vulnerable to a race condition due to non-atomic find-then-delete operations on a shared relational database under READ_COMMITTED isolation. A remote attacker can exploit this to obtain multiple valid access tokens from a single autho...

CVE-2026-79650

The Apache CXF OIDC relying-party component is vulnerable to an open redirect (CWE-601) where users can be redirected to an attacker-controlled URL after successful authentication. The root cause is that attacker-controlled state parameters are preserved and used as redirect targets without verif...