GCVE - cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*

part: a version: 3.1.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Cxf (`50f1d7f0-1ad2-57a6-bb7b-0f9ea8944dab`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/cxf`	purl2cpe	2026-06-01 10:14:23.700976
`pkg:github/apache/cxf`	purl2cpe	2026-06-01 10:14:23.700978
`pkg:maven/org.apache.cxf/cxf`	purl2cpe	2026-06-01 10:14:23.700979
`pkg:rpm/fedora/cxf`	purl2cpe	2026-06-01 10:14:23.700981

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-3156`	vulnerable	2026-06-08 05:09:26.681855	Details available The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks. Published: 2017-08-10T18:00:00.000Z Updated: 2024-09-16T23:16:01.996Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96398 https://access.redhat.com/errata/RHSA-2017:1832 http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-8739`	vulnerable	2026-06-08 05:08:14.753168	Details available The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk. Published: 2017-08-10T18:00:00.000Z Updated: 2024-09-16T22:51:45.164Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/97579 https://access.redhat.com/errata/RHSA-2017:0868 http://www.securitytracker.com/id/1037544 http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6812`	vulnerable	2026-06-08 05:08:11.025376	Details available The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client. Published: 2017-08-10T16:00:00.000Z Updated: 2024-09-17T00:51:19.414Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2017:0868 http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc http://www.securitytracker.com/id/1037543 https://issues.apache.org/jira/browse/CXF-6216 http://www.securityfocus.com/bid/97582	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.