Skip to content
OpenAdvisories
Medium WID-SEC-2026-2682 12 CVEs

Apache CXF: Mehrere Schwachstellen

Published Aug 5, 2026 · Updated Nov 11, 2026 · Revision 16 · de

Vendor: Apache Vendor: IBM Vendor: Oracle Vendor: Red Hat Product: Business Automation Workflow Product: CXF Product: Enterprise Linux Product: Linux Product: MQ Product: QRadar SIEM Product: Security Verify Access Product: SPSS Product: Tivoli Monitoring Product: Tivoli Network Manager Product: WebSphere Application Server Product: WebSphere Application Server - Liberty Product: WebSphere Service Registry and Repository Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Apache CXF ist ein Open Source-Web Service-Framework.

Vulnerabilities 12

  • Critical 9.8
    CVE-2026-66909

    Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

    Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized ob…

    Apache Software Foundation Apache CXF
  • Critical 9.8
    CVE-2026-68079

    Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

    In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization c…

    Apache Software Foundation Apache CXF
  • Critical 9.1
    CVE-2026-61466

    Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

    In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client…

    Apache Software Foundation Apache CXF
  • Critical 9.1
    CVE-2026-63687

    Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

    Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known …

    Apache Software Foundation Apache CXF
  • Critical 9.1
    CVE-2026-65583

    Apache CXF: Self-issued ID token claims validation skipped

    Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued …

    Apache Software Foundation Apache CXF
  • High 8.1
    CVE-2026-57817

    Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

    The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the…

    Apache Software Foundation Apache CXF
  • High 8.1
    CVE-2026-57818

    Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

    A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-54225

    Apache CXF: Denial of Service attack via large attachments

    Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitl…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-57819

    Apache CXF: No default restriction on the amount of form parameters per message

    Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large …

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-64958

    Apache CXF: Denial of service via message header attachments

    An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this i…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-65432

    Apache CXF: XXE via WSDL/XSD import parsing

    Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declar…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-68481

    Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

    In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST…

    Apache Software Foundation Apache CXF

Revision history

  1. #16

    Neue Updates von Red Hat aufgenommen

  2. #15

    Neue Updates von Red Hat aufgenommen

  3. #14

    Neue Updates von Oracle Linux aufgenommen

  4. #13

    Neue Updates von IBM aufgenommen

  5. #12

    Neue Updates von Red Hat aufgenommen

  6. #11

    Neue Updates von Red Hat aufgenommen

  7. #10

    Neue Updates von IBM aufgenommen

  8. #9

    Neue Updates von Red Hat aufgenommen

  9. #8

    Neue Updates von IBM aufgenommen

  10. #7

    Neue Updates von IBM und IBM-APAR aufgenommen

  11. #6

    Neue Updates von IBM aufgenommen

  12. #5

    Neue Updates von IBM aufgenommen

  13. #4

    Neue Updates von IBM aufgenommen

  14. #3

    Neue Updates von IBM aufgenommen

  15. #2

    CVE's ergänzt

  16. #1

    Initiale Fassung

References