Approved changes feed: RSS · Atom
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Cxf (50f1d7f0-1ad2-57a6-bb7b-0f9ea8944dab) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/cxf |
purl2cpe | 2026-06-01 10:14:23.661332 |
pkg:github/apache/cxf |
purl2cpe | 2026-06-01 10:14:23.661334 |
pkg:maven/org.apache.cxf/cxf |
purl2cpe | 2026-06-01 10:14:23.661335 |
pkg:rpm/fedora/cxf |
purl2cpe | 2026-06-01 10:14:23.661337 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-48913 |
vulnerable | 2026-06-08 07:29:12.229266 |
Apache CXF: Untrusted JMS configuration can lead to RCE
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.
Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Published: 2025-08-08T09:21:22.208Z
Updated: 2026-02-26T17:49:47.500Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23184 |
vulnerable | 2026-06-08 07:10:55.297937 |
Apache CXF: Denial of Service vulnerability with temporary files
MEDIUM (5.9)
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Published: 2025-01-21T09:35:37.468Z
Updated: 2025-12-15T15:58:16.867Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41172 |
vulnerable | 2026-06-08 06:43:54.244132 |
Apache CXF: Unrestricted memory consumption in CXF HTTP clients
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
Published: 2024-07-19T08:50:43.766Z
Updated: 2024-09-13T17:05:12.209Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32007 |
vulnerable | 2026-06-08 06:35:32.618260 |
Apache CXF Denial of Service vulnerability in JOSE
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
Published: 2024-07-19T08:50:31.832Z
Updated: 2024-09-13T17:04:44.644Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29736 |
vulnerable | 2026-06-08 06:33:29.262342 |
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
Published: 2024-07-19T08:50:08.265Z
Updated: 2024-11-15T13:08:15.763Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28752 |
vulnerable | 2026-06-08 06:33:27.189565 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46364 |
vulnerable | 2026-06-08 05:50:38.731773 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46363 |
vulnerable | 2026-06-08 05:50:38.731148 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30468 |
vulnerable | 2026-06-08 05:31:51.051150 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22696 |
vulnerable | 2026-06-08 05:30:01.079029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1954 |
vulnerable | 2026-06-08 05:21:03.749044 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13954 |
vulnerable | 2026-06-08 05:18:01.602550 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17573 |
vulnerable | 2026-06-08 05:13:10.761863 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12423 |
vulnerable | 2026-06-08 05:12:39.131575 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12419 |
vulnerable | 2026-06-08 05:12:39.124279 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12406 |
vulnerable | 2026-06-08 05:12:39.068045 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8039 |
vulnerable | 2026-06-08 05:12:05.125369 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5656 |
vulnerable | 2026-06-08 05:09:47.773669 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5653 |
vulnerable | 2026-06-08 05:09:47.763040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-3156 |
vulnerable | 2026-06-08 05:09:26.680332 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12624 |
vulnerable | 2026-06-08 05:08:47.399998 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8739 |
vulnerable | 2026-06-08 05:08:14.753114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6812 |
vulnerable | 2026-06-08 05:08:11.023915 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5253 |
vulnerable | 2026-06-08 05:06:49.344181 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3623 |
vulnerable | 2026-06-08 05:05:41.878854 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3584 |
vulnerable | 2026-06-08 05:05:33.607189 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-0110 |
vulnerable | 2026-06-08 05:05:11.540070 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-0109 |
vulnerable | 2026-06-08 05:05:11.527618 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-0035 |
vulnerable | 2026-06-08 05:05:10.852143 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-0034 |
vulnerable | 2026-06-08 05:05:10.839383 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-0239 |
vulnerable | 2026-06-08 05:03:46.369692 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-5786 |
vulnerable | 2026-06-08 05:02:58.244331 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-5633 |
vulnerable | 2026-06-08 05:02:57.623827 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-3451 |
vulnerable | 2026-06-08 05:02:09.957375 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-2487 |
vulnerable | 2026-06-08 04:58:07.212257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-2076 |
vulnerable | 2026-06-08 04:54:11.610105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.