CVE-2026-49875

CVE-2026-49875

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrad…

Vulnerability class: XXE (XML External Entity)

Weakness classification (CWE)

References