Apache CXF: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• Critical 9.8
  CVE-2026-50628

  Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

  A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recomme…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven
  Jun 12, 2026
• Critical 9.1
  CVE-2026-50627

  Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

  The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading t…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven
  Jun 12, 2026
• High 8.1
  CVE-2026-50632

  Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

  A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. User…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-transports-jms Maven
  Jun 12, 2026
• High 8.1
  CVE-2026-50633

  Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

  A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended …

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-integration-jca Maven
  Jun 12, 2026
• High 7.5
  CVE-2026-50645

  Apache CXF: No restriction on attachment headers per message

  There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2…

  Apache Software Foundation Apache CXF apache-tika-3.2 apache-tika-3.1 Wolfi Maven
  Jun 12, 2026
• High 7.4
  CVE-2026-50631

  Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing

  A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven
  Jun 12, 2026
• Medium 6.5
  CVE-2026-49875

  Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

  Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 o…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Jun 12, 2026
• Medium 6.5
  CVE-2026-50630

  Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

  A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker c…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven
  Jun 12, 2026
• Medium 6.5
  CVE-2026-50634

  Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

  A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted `Content-Type` or protected HTTP-h…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-jose-jaxrs Maven
  Jun 12, 2026
• Medium 5.3
  CVE-2026-50629

  Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier

  The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven
  Jun 12, 2026
• Medium 4.8
  CVE-2026-50623

  Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService

  An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticate…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-oauth2 Maven
  Jun 12, 2026

Revision history

1. 2026-11-03 #21

   Neue Updates von IBM aufgenommen

2. 2026-10-28 #20

   Neue Updates von IBM aufgenommen

3. 2026-10-15 #19

   Neue Updates von IBM aufgenommen

4. 2026-10-13 #18

   Neue Updates von IBM aufgenommen

5. 2026-10-04 #17

   Neue Updates von IBM aufgenommen

6. 2026-09-22 #16

   Neue Updates von Red Hat und IBM aufgenommen

7. 2026-09-21 #15

   Neue Updates von IBM aufgenommen

8. 2026-09-08 #14

   Neue Updates von IBM und IBM-APAR aufgenommen

9. 2026-08-17 #13

   Neue Updates von IBM aufgenommen

10. 2026-08-13 #12

    Neue Updates von IBM aufgenommen

11. 2026-08-12 #11

    Neue Updates von IBM aufgenommen

12. 2026-07-29 #10

    Neue Updates von IBM aufgenommen

13. 2026-07-23 #9

    Neue Updates von IBM aufgenommen

14. 2026-07-15 #8

    Neue Updates von IBM aufgenommen

15. 2026-07-09 #7

    Neue Updates von Red Hat aufgenommen

16. 2026-07-08 #6

    Neue Updates von Red Hat aufgenommen

17. 2026-07-01 #5

    Neue Updates von IBM aufgenommen

18. 2026-06-30 #4

    Neue Updates von IBM aufgenommen

19. 2026-06-21 #3

    Neue Updates aufgenommen

20. 2026-06-14 #2

    Referenz(en) aufgenommen: EUVD-2026-36400, EUVD-2026-36403, EUVD-2026-36402, EUVD-2026-36401, EUVD-2026-36399, EUVD-2026-36398, EUVD-2026-36397, EUVD-2026-36396, EUVD-2026-36395, EUVD-2026-36393, EUVD-2026-36394

21. 2026-06-11 #1

    Initiale Fassung

References

• IBM Security Bulletin 7278870 vom 2026-07-02
  https://www.ibm.com/support/pages/node/7278870
• IBM Security Bulletin 7278576 vom 2026-06-30
  https://www.ibm.com/support/pages/node/7278576
• Apache CXF Releases Download vom 2026-06-11
  https://cxf.apache.org/download.html
• Apache CXF Security Advisory CVE-2026-49875 vom 2026-06-11
  https://cxf.apache.org/security-advisories.data/CVE-2026-49875.txt
• Apache CXF Security Advisory CVE-2026-50623 vom 2026-06-11
  https://cxf.apache.org/security-advisories.data/CVE-2026-50623.txt
• Apache CXF Security Advisory CVE-2026-50627 vom 2026-06-11
  https://cxf.apache.org/security-advisories.data/CVE-2026-50627.txt
• Apache CXF Security Advisory CVE-2026-50628 vom 2026-06-11
  https://cxf.apache.org/security-advisories.data/CVE-2026-50628.txt
• Apache CXF Security Advisory CVE-2026-50629 vom 2026-06-11
  https://cxf.apache.org/security-advisories.data/CVE-2026-50629.txt
• Apache CXF Security Advisory CVE-2026-50630 vom 2026-06-11
  https://cxf.apache.org/security-advisories.data/CVE-2026-50630.txt
• PDFreactor 12 Hotfix Release 12.6.1 vom 2026-06-19
  https://www.pdfreactor.com/pdfreactor-12-hotfix-release-12-6-1-now-available/
• Red Hat Security Advisory RHSA-2026:36839 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36839
• Red Hat Security Advisory RHSA-2026:37390 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:37390
• IBM Security Bulletin 7280105 vom 2026-07-15
  https://www.ibm.com/support/pages/node/7280105
• IBM Security Bulletin 7281066 vom 2026-07-24
  https://www.ibm.com/support/pages/node/7281066
• IBM Security Bulletin 7281835 vom 2026-07-29
  https://www.ibm.com/support/pages/node/7281835
• IBM Security Bulletin 7283567 vom 2026-08-13
  https://www.ibm.com/support/pages/node/7283567
• IBM Security Bulletin 7283750 vom 2026-08-14
  https://www.ibm.com/support/pages/node/7283750
• IBM Security Bulletin 7283975 vom 2026-08-17
  https://www.ibm.com/support/pages/node/7283975
• IBM Security Bulletin 7286761 vom 2026-09-09
  https://www.ibm.com/support/pages/node/7286761
• IBM Security Bulletin 7286664 vom 2026-09-08
  https://www.ibm.com/support/pages/node/7286664
• IBM Security Bulletin 7288812 vom 2026-09-22
  https://www.ibm.com/support/pages/node/7288812
• Red Hat Security Advisory RHSA-2026:70277 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70277
• IBM Security Bulletin 7289064 vom 2026-09-23
  https://www.ibm.com/support/pages/node/7289064
• Red Hat Security Advisory RHSA-2026:70228 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70228
• Red Hat Security Advisory RHSA-2026:70229 vom 2026-09-22
  https://access.redhat.com/errata/RHSA-2026:70229
• IBM Security Bulletin 7290794 vom 2026-10-03
  https://www.ibm.com/support/pages/node/7290794
• IBM Security Bulletin 7290698 vom 2026-10-02
  https://www.ibm.com/support/pages/node/7290698
• IBM Security Bulletin 7292240 vom 2026-10-13
  https://www.ibm.com/support/pages/node/7292240
• IBM Security Bulletin 7292672 vom 2026-10-15
  https://www.ibm.com/support/pages/node/7292672
• IBM Security Bulletin 7294463 vom 2026-10-29
  https://www.ibm.com/support/pages/node/7294463
• IBM Security Bulletin 7295452 vom 2026-11-03
  https://www.ibm.com/support/pages/node/7295452