Apache CXF: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• High 7.5
  CVE-2026-44417

  Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

  The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are re…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-transports-jms Maven
  May 22, 2026
• Medium 5.3
  CVE-2026-44618

  Apache CXF: XXE vulnerability in WS-Transfer functionality

  Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-ws-transfer Maven
  May 22, 2026
• Medium 4.3
  CVE-2026-44930

  Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

  An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.  Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix t…

  Apache Software Foundation Apache CXF org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap Maven
  May 22, 2026

Revision history

1. 2026-09-22 #4

   Neue Updates von Red Hat aufgenommen

2. 2026-07-09 #3

   Neue Updates von Red Hat aufgenommen

3. 2026-05-25 #2

   Referenz(en) aufgenommen: EUVD-2026-31433, EUVD-2026-31434, EUVD-2026-31432

4. 2026-05-21 #1

   Initiale Fassung

References

• Apache CXF Security Advisory CVE-2026-44417 vom 2026-05-21
  https://cxf.apache.org/security-advisories.data/CVE-2026-44417.txt
• Apache CXF Security Advisory CVE-2026-44618 vom 2026-05-21
  https://cxf.apache.org/security-advisories.data/CVE-2026-44618.txt
• Apache CXF Security Advisory CVE-2026-44930 vom 2026-05-21
  https://cxf.apache.org/security-advisories.data/CVE-2026-44930.txt
• Apache CXF
  https://cxf.apache.org/
• Red Hat Security Advisory RHSA-2026:37390 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:37390
• Red Hat Security Advisory RHSA-2026:70229 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70229
• Red Hat Security Advisory RHSA-2026:70277 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70277
• Red Hat Security Advisory RHSA-2026:70228 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70228
• Red Hat Security Advisory RHSA-2026:70230 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70230