Skip to content
OpenAdvisories
High WID-SEC-2026-3824 10 CVEs

Apache CXF: Mehrere Schwachstellen

Published Oct 8, 2026 · Updated Nov 5, 2026 · Revision 4 · de-DE

Vendor: Apache Vendor: IBM Vendor: Red Hat Product: CXF Product: Enterprise Linux Product: WebSphere Application Server Product: WebSphere Application Server - Liberty Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und offenzulegen, Benutzer auf vom Angreifer kontrollierte Websites umzuleiten oder Denial-of-Service-Zustände auszulösen.

Product

Apache CXF ist ein Open Source-Web Service-Framework.

Vulnerabilities 10

  • Critical 9.1
    CVE-2026-107938

    Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

    In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was…

    Apache Software Foundation Apache CXF
  • Critical 9.1
    CVE-2026-97468

    Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

    Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented token had already been v…

    Apache Software Foundation Apache CXF
  • High 8.1
    CVE-2026-73179

    Apache CXF: JPA authorization-code consume is non-atomic

    Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange req…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-100227

    Apache CXF: XML Signature wrapping in JAX-RS XML Security

    Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-107937

    Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

    In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physic…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-108039

    Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

    By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for …

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-78384

    Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

    CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key w…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-86463

    Apache CXF: FIQL Query Parser Denial of Service

    Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive C…

    Apache Software Foundation Apache CXF
  • High 7.5
    CVE-2026-97791

    Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

    In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unaut…

    Apache Software Foundation Apache CXF
  • Medium 6.1
    CVE-2026-79650

    Apache CXF: OIDC RP Open Redirect

    Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating tha…

    Apache Software Foundation Apache CXF

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von IBM aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-95702, EUVD-2026-95701, EUVD-2026-95700, EUVD-2026-95699, EUVD-2026-95698, EUVD-2026-95697, EUVD-2026-95696, EUVD-2026-95695, EUVD-2026-95704, EUVD-2026-95703

  4. #1

    Initiale Fassung

References