CVE-2022-46364

CVE-2022-46364 describes an SSRF in Apache CXF when parsing the href attribute of XOP:Include in MTOM requests, affecting CXF versions before 3.5.5 and 3.4.10. The vulnerability enables SSRF-style attacks on webservices with at least one parameter. Remediation is to upgrade to CXF 3.5.5+ or 3.4.1...

CVE-2024-28752

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache CXF (versions before 4.0.4, 3.6.3, and 3.5.8) due to insufficient validation of user input data when using Aegis DataBinding . An attacker can exploit this by providing a specially crafted argument to perform SSRF attacks on web ...

CVE-2025-23184

CVE-2025-23184 describes a potential denial-of-service in Apache CXF where CachedOutputStream instances may not be closed in edge cases, risking file-system exhaustion if backed by temporary files on servers or clients. Affected CXF versions are before 3.5.10, 3.6.5, and 4.0.6. The NVD/Apache-mod...

CVE-2022-46363

CVE-2022-46363 involves Apache CXF. The vulnerability arises when CXFServlet is configured with both static-resources-list and redirect-query-check attributes, enabling remote directory listing or code exfiltration. Affected CXF versions are pre-3.5.5 and pre-3.4.10. The IBM security bulletin cor...

CVE-2026-49875

Apache CXF is affected by an XML External Entity (XXE) issue described as CVE-2026-49875. The vulnerability arises because EndpointReferenceUtils and W3CMultiSchemaFactory construct a SAXParserFactory without proper JAXP hardening, enabling out-of-band (OOB) external entity resolution. Affected c...

CVE-2021-30468

CVE-2021-30468 is a denial-of-service issue in Apache CXF caused by an infinite loop in the JsonMapObjectReaderWriter. Connected IBM advisories confirm the vulnerability affects CXF usage in IBM products (e.g., Tivoli Network Manager IP Edition and IBM Security Guardium) and list the affected CXF...

CVE-2021-22696

CVE-2021-22696 affects Apache CXF where improper validation of the request_uri parameter in OAuth 2 flows allows a remote attacker to cause a denial of service on the authorization server. The issue occurs when a JWT-based request uses a request_uri to fetch the token, with insufficient validatio...

CVE-2025-48913

The Apache CXF framework is vulnerable to Remote Code Execution (RCE) due to an untrusted JMS configuration that allowed the use of RMI or LDAP URLs. While a fix was initially introduced, subsequent reports (notably CVE-2026-44417 ) indicate that the previous patch was incomplete and left an alte...

CVE-2019-12406

CVE-2019-12406 describes a denial-of-service in Apache CXF where a message can include an excessive number of attachments. The fixed releases (CXF 3.3.4 and 3.2.11) enforce a default attachment limit of 50, configurable via the attachment-max-count property. IBM/materials reference CXF and note a...

CVE-2026-50645

CVE-2026-50645 affects Apache CXF during message deserialization, where there is no restriction on the number of attachment headers. This can enable uncontrolled resource consumption and a denial-of-service condition. The issue is mitigated by limiting attachments per message to a default maximum...

CVE-2018-8039

CVE-2018-8039: Apache CXF could allow a remote attacker to conduct a man‑in‑the‑middle attack due to TLS hostname verification not working when using com.sun.net.ssl. In CXF versions prior to 3.2.5 and 3.1.16 the exception is not properly propagated, leaving clients vulnerable. IBM/Oracle/Red Hat...

CVE-2019-12423

CVE-2019-12423 affects Apache CXF OpenId Connect JWK Keys service. When rs.security.keystore.type is set to “jwk”, the service may return all keys from the JWK file, potentially exposing private/secret key credentials if present, though newer CXF releases restrict to the key with the matching ali...

CVE-2026-68079

A flaw in the DefaultEncryptingCodeDataProvider component of Apache CXF allows a remote attacker to redeem a captured authorization code an unlimited number of times. This is caused by a defect in the removeCodeGrant functionality, which fails to properly invalidate used authorization codes, viol...

CVE-2024-29736

CVE-2024-29736: Apache CXF WADL stylesheet SSRF. The issue arises from improper validation of the WADL stylesheet parameter, enabling SSRF against REST services when a custom stylesheet parameter is configured. Affected CXF versions are before 4.0.5, 3.6.4, and 3.5.9. Mitigation: upgrade CXF to 4...

CVE-2026-66909

The Apache CXF JMS transport component is vulnerable to unsafe deserialization because it processes the body of inbound JMS ObjectMessages using native Java deserialization without any type restrictions. A remote attacker capable of placing a message on the service's JMS destination can submit a ...

CVE-2020-13954

CVE-2020-13954 is an Apache CXF cross-site scripting (XSS) vulnerability exposed via the /services listing page. The issue arises from improper validation of user-supplied input through styleSheetPath, enabling an attacker to inject script when the URL is visited. Public documentation in the init...

CVE-2020-1954

CVE-2020-1954 affects Apache CXF JMX integration; a MITM is possible if the createMBServerConnectorFactory setting on the InstrumentationManagerImpl is not disabled, allowing an on-host attacker to rebind the JMX registry and proxy traffic to access exchanged data. The issue is documented across ...

CVE-2026-44417

A vulnerability in Apache CXF allows for Remote Code Execution (RCE) if untrusted users are permitted to configure JMS. This issue stems from an incomplete fix for CVE-2025-48913, where additional code paths remain susceptible to exploitation. The vulnerability affects the cxf-rt-transports-jms c...

CVE-2026-64958

The Apache CXF library is susceptible to a denial of service (DoS) attack due to an incomplete fix for CVE-2026-50645 . An attacker can trigger this by sending a message containing an excessive number of attachment headers , leading to uncontrolled resource consumption. This vulnerability affects...

CVE-2026-61466

The Apache CXF services framework, specifically the org.apache.cxf:cxf-rt-rs-security-oauth2 package, contains a vulnerability in its OAuth2 Dynamic Client Registration endpoint. The root cause is that the authorization server accepts and stores the scope value from the client registration reques...

CVE-2026-65583

The Apache CXF Runtime OpenID Connect library (org.apache.cxf:cxf-rt-rs-security-sso-oidc) contains an authentication bypass vulnerability due to insufficient validation of required claims in self-issued OIDC ID tokens. Specifically, the OIDC relying-party token validation may fail to enforce che...

CVE-2024-32007

CVE-2024-32007 affects Apache CXF: improper input validation of the p2c parameter in JOSE code can allow a denial-of-service via a token with a large p2c. Affected branches include CXF 4.0.x (before 4.0.5) and older 3.6.x/3.5.x lines (3.6.4, 3.5.9). Mitigation is to upgrade to a fixed release (i....

CVE-2026-54225

Apache CXF is vulnerable to a denial of service (DoS) attack due to the lack of a default maximum attachment size via the "attachment-max-size" configuration option. If a user fails to explicitly set this limit, an attacker can exploit the vulnerability to cause resource exhaustion. This issue is...

CVE-2012-3451

CVE-2012-3451 affects Apache CXF. Vulnerable versions: CXF 2.4.x before 2.4.9; 2.5.x before 2.5.5; 2.6.x before 2.6.2. An attacker can cause remote web-service operations to be executed by sending a SOAP Action header that is inconsistent with the message body. The impact is “remote execution of ...

CVE-2026-50634

A vulnerability exists in Apache CXF 's JwsJsonContainerRequestFilter where the system may process metadata that has not been authenticated by the accepted signature. This flaw allows an attacker to bypass assumptions regarding verified Content-Type or protected HTTP-header metadata, potentially ...

CVE-2026-57817

A flaw in Apache CXF allows for Authorization Code Substitution/Injection attacks during the OpenID Connect Hybrid Flow. The vulnerability occurs because the cxf-rt-rs-security-sso-oidc library (and the broader cxf component) fails to enforce the validation of the c_hash parameter, as required by...

CVE-2026-65432

The Apache CXF library is vulnerable to XML External Entity (XXE) attacks because it fails to extend protections to imported content. While Apache CXF uses a hardened StaxUtils path to disable DTDs and external entities for top-level WSDLs, any or references are passed to WSDL4J . Unlike CXF, W...

CVE-2026-44930

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-50633

A JNDI Injection vulnerability exists in the Apache CXF JCA integration module, specifically within DispatchMDBMessageListenerImpl . An attacker who can manipulate the JCA deployment descriptor (ra.xml ) or runtime activation parameters can achieve code execution . To mitigate this risk, users ar...

CVE-2026-57819

The Apache CXF library allows for configuring the number of form parameters in a JAX-RS message via the "maxFormParameterCount" option. However, because no default limit is set, the software is susceptible to denial of service (DoS) attacks when processing requests containing a very large number ...

CVE-2026-50627

The CVE-2026-50627 issue affects Apache CXF’s JwtAccessTokenValidator, which fails to validate the aud (Audience) claim in incoming JWT access tokens. As described in multiple sources (NVD/Red Hat/CVE List/etc.), a token issued for one Resource Server could be replayed against a different Resourc...

CVE-2015-5253

CVE-2015-5253 affects Apache CXF SAML Web SSO module: remote authenticated bypass via a crafted SAML response with a valid signed assertion, related to a wrapping attack. Affected versions include CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3. The vulnerability can bypass authenti...

CVE-2026-50632

Apache CXF is affected by CVE-2026-50632 , which involves an incomplete fix for a previous advisory (CVE-2026-44417 ) regarding untrusted JMS configurations. This vulnerability can allow arbitrary code execution if untrusted users are permitted to configure JMS for the framework. The issue is spe...

CVE-2026-50628

CVE-2026-50628 concerns Apache CXF’s OAuthRequestFilter, where a logic error creates an inverted IP binding check: legitimate requests from the bound IP are rejected while requests from other IPs are allowed. Red Hat’s advisory attributes this to the OAuthRequestFilter component of CXF and notes ...

CVE-2026-57818

A Time-of-check Time-of-use (TOCTOU) race condition exists in the JCacheCodeDataProvider component of Apache CXF (specifically within cxf-rt-rs-security-oauth2). This flaw allows a remote attacker to perform an authorization code replay by submitting concurrent requests to redeem a single authori...

CVE-2026-44618

The Apache CXF framework is vulnerable to XML External Entity (XXE) attacks due to an insecure XML parser configuration in the WS-Transfer module. This flaw allows attackers to process XML input containing external entity references, potentially leading to unauthorized access to internal files or...

CVE-2026-68481

Apache CXF is vulnerable to improper authorization due to a flaw in the DefaultEncryptingOAuthDataProvider process. This issue allows revoked access and refresh tokens to remain valid and be reported as active by the TokenIntrospectionService, bypassing intended revocation processes and potential...

CVE-2026-50631

A race condition in the AbstractOAuthDataProvider of Apache CXF allows concurrent requests using the same Refresh Token to bypass single-use semantics. When the recycleRefreshTokens parameter is set to false , an attacker can replay a leaked refresh token concurrently to generate multiple valid A...

CVE-2026-63687

A security bypass vulnerability exists in Apache CXF within the cxf-rt-rs-security-oauth2 component. The JwtRequestCodeFilter fails to exclude security-sensitive parameters when copying claims from a signed request JWT into the authorization parameter map. An attacker who possesses or compromises...

CVE-2026-50623

An authentication bypass vulnerability exists in the Apache CXF OAuth2 TokenIntrospectionService component. The root cause is a missing throw keyword during the security context check, which allows an unauthenticated network attacker to access the introspection endpoint at /services/oauth2/intros...

CVE-2026-50629

The Apache CXF framework is vulnerable to Log Injection (CVE-2026-50629) because the clientId parameter from incoming HTTP requests is concatenated into OAuth2 server log warning messages without sanitizing control characters. This flaw allows an attacker to inject arbitrary content, including fa...

CVE-2026-50630

A CRLF injection vulnerability exists in the Apache CXF OAuth2 AuthorizationUtils class. The root cause is the lack of sanitization for Carriage Return (CR) and Line Feed (LF) characters when the 'realm' parameter is concatenated into the WWW-Authenticate response header. An attacker capable of c...