Skip to content
OpenAdvisories
High · 7.5 CVE-2026-44417 EUVD-2026-31432GHSA-2hvc-5c6v-f533

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Published May 22, 2026 · Updated Jul 15, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache CXF Package: org.apache.cxf:cxf-rt-transports-jms Ecosystem: Maven

Description

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache CXF 4.2.0 – < 4.2.1, 4.0.0 – < 4.1.6, < 3.6.11 4.2.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-8.redhat_00024.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.1.7-1.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.5-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.85.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.7-1.redhat_00002.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.8.0-1.GA_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.54-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-5.redhat_00008.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ironjacamar +8 3.0.22-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jackson-core +12 2.18.9-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.5-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.7-4.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxbintros 2.1.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.3-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.31-1.SP2_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-api 3.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-common-tools 2.2.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.4.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-jaxws-undertow-httpspi 3.0.1-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-spi 5.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.11-2.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-log4j 2.25.4-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-neethi 3.2.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-netty +14 4.1.136-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.4-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-parsson 1.1.9-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-saaj-impl +1 3.0.6-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.18-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-undertow 2.3.26-2.SP3_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.8-9.GA_redhat_00006.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.6.11-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-12.GA_redhat_00048.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ws-commons-XmlSchema 2.3.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.cxf:cxf-rt-transports-jms >= 4.2.0, < 4.2.1 4.2.1 GHSA-2hvc-5c6v-f533
Maven org.apache.cxf:cxf-rt-transports-jms >= 4.1.0, < 4.1.6 4.1.6 GHSA-2hvc-5c6v-f533
Maven org.apache.cxf:cxf-rt-transports-jms < 3.6.11 3.6.11 GHSA-2hvc-5c6v-f533

Advisories 5

References