Description
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 3.5 – < 3.5.5, 3.4 – < 3.4.10 | 3.5.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.6-1.redhat_00001.1.el7sso | RHSA-2023:1045, RHSA-2023:1044, RHSA-2023:1043 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-4.redhat_00003.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +7 | 2.10.4-2.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-modules-base +1 | 2.10.4-4.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jettison | 1.3.8-2.redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy +16 | 3.0.27-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy-rxjava2 +2 | 3.11.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-snakeyaml | 1.33.0-1.SP1_redhat_00001.1.el7eap | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-velocity | 1.7.0-3.redhat_00006.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.9-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.12-3.GA_redhat_00002.1.el7eap | RHSA-2025:1747 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf-core | < 3.4.10 | 3.4.10 | GHSA-3w37-5p3p-jv92 |
| Maven | org.apache.cxf:cxf-core | >= 3.5.0, < 3.5.5 | 3.5.5 | GHSA-3w37-5p3p-jv92 |
Advisories 8
- RHSA-2025:1747 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:1746 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2023:1045 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1044 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1043 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-2316 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
References
- https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c vendor-advisory