Apache Cxf
69 CVEs affecting Apache Cxf. Latest disclosed: 2026-08-06. Critical: 16, High: 23.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68079 | Critical | 9.8 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementati… |
CVE-2026-66909 | Critical | 9.8 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any at… |
CVE-2026-50628 | Critical | 9.8 | 2026-06-12 | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP addres… |
CVE-2026-49875 | Critical | 9.8 | 2026-06-12 | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enablin… |
CVE-2026-44930 | Critical | 9.8 | 2026-05-22 | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates fr… |
CVE-2025-48913 | Critical | 9.8 | 2025-08-08 | If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities… |
CVE-2022-46364 | Critical | 9.8 | 2022-12-13 | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perf… |
CVE-2019-12419 | Critical | 9.8 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability i… |
CVE-2012-0803 | Critical | 9.8 | 2017-08-08 | The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SO… |
CVE-2010-2076 | Critical | 9.8 | 2010-08-19 | Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache… |
CVE-2024-28752 | Critical | 9.3 | 2024-03-15 | A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on we… |
CVE-2026-65583 | Critical | 9.1 | 2026-08-06 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and s… |
CVE-2026-63687 | Critical | 9.1 | 2026-08-06 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive paramet… |
CVE-2026-61466 | Critical | 9.1 | 2026-08-06 | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration… |
CVE-2026-50627 | Critical | 9.1 | 2026-06-12 | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one R… |
CVE-2024-29736 | Critical | 9.1 | 2024-07-19 | A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on RE… |
CVE-2026-57818 | High | 8.1 | 2026-08-06 | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the is… |
CVE-2026-57817 | High | 8.1 | 2026-08-06 | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is i… |
CVE-2026-50633 | High | 8.1 | 2026-06-12 | A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipu… |
CVE-2026-50632 | High | 8.1 | 2026-06-12 | A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can all… |