Description
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.
Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.1.0 – < 4.1.3, 4.0.0 – < 4.0.9, < 3.6.8 | 4.1.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-6.redhat_00006.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-eclipse-jgit | 5.13.5.202508271544-1.r_redhat_00001.1.el7eap | RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hibernate +5 | 5.1.17-4.Final_redhat_00005.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jbossws-cxf | 5.1.11-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-19.SP17_redhat_00001.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.14-4.GA_redhat_00003.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.17-5.GA_redhat_00006.1.el7eap | RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-apache-cxf +3 | 3.5.11-1.SP1_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-eclipse-jgit | 5.13.5.202508271544-2.r_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-hibernate +4 | 5.3.38-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-marshalling +1 | 2.0.16-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.124-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.39-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.24-4.GA_redhat_00002.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.24-4.GA_redhat_00002.1.el8eap | RHSA-2026:4917, RHSA-2026:4916 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-lang | 3.18.0-1.redhat_00002.1.el8eap | RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.9-4.redhat_00002.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-cxf-xjc-dv +5 | 4.1.0-1.redhat_00001.1.el8eap | RHSA-2025:17317 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.9.1-3.GA_redhat_00004.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.3.4-1.Final_redhat_00001.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.127-1.Final_redhat_00001.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-opensaml +13 | 4.3.2-2.redhat_00002.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.9-8.GA_redhat_00008.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-wss4j +6 | 3.0.4-1.redhat_00002.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
| Red Hat JBoss EAP 8 | eap8-xml-security | 3.0.5-1.redhat_00001.1.el8eap | RHSA-2025:17317, RHSA-2025:17298 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | wildfly +4 | 36.0.1-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-transports-jms | < 3.6.8 | 3.6.8 | GHSA-g4px-6qhm-hqjm |
| Maven | org.apache.cxf:cxf-rt-transports-jms | >= 4.0.0, < 4.0.9 | 4.0.9 | GHSA-g4px-6qhm-hqjm |
| Maven | org.apache.cxf:cxf-rt-transports-jms | >= 4.1.0, < 4.1.3 | 4.1.3 | GHSA-g4px-6qhm-hqjm |
Advisories 15
- RHSA-2026:4917 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4916 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4915 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:17317 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.9 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:17298 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:6011 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.17 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:6012 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.14 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2025-1751 Apache CXF: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Mar 29, 2026
- WID-SEC-2026-0862 RealObjects PDFreactor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 25, 2026
- NCSC-2025-0323 Kwetsbaarheden verholpen in SAP Producten NCSC-NL (Netherlands) · Oct 17, 2025
- WID-SEC-2025-2265 SAP Patchday Oktober 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2025
References
- https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83 vendor-advisory