Apache Cxf
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Cxf (f5730434-77f3-59e0-a167-672dce7921cd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-68079 |
vulnerable | 2026-09-16 04:34:00.338099 |
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Published: 2026-08-06T11:22:57.938Z
Updated: 2026-08-07T00:01:53.998Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-68481 |
vulnerable | 2026-09-16 04:34:00.285838 |
Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Published: 2026-08-06T11:22:37.929Z
Updated: 2026-08-07T00:01:55.439Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57819 |
vulnerable | 2026-09-16 04:33:40.564401 |
Apache CXF: No default restriction on the amount of form parameters per message
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.
Published: 2026-08-06T10:12:26.243Z
Updated: 2026-08-07T00:01:43.594Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57818 |
vulnerable | 2026-09-16 04:33:40.449902 |
Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Published: 2026-08-06T11:24:53.590Z
Updated: 2026-08-07T00:01:42.058Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57817 |
vulnerable | 2026-09-16 04:33:40.139986 |
Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Published: 2026-08-06T10:24:05.877Z
Updated: 2026-08-07T03:55:29.695Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54225 |
vulnerable | 2026-09-16 04:33:28.619399 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64958 |
vulnerable | 2026-09-16 04:33:11.405458 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-65583 |
vulnerable | 2026-09-16 04:33:07.798376 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-65432 |
vulnerable | 2026-09-16 04:33:07.702719 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-66909 |
vulnerable | 2026-09-16 04:32:55.293829 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-63687 |
vulnerable | 2026-09-16 04:32:49.763799 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-61466 |
vulnerable | 2026-09-16 04:32:44.504283 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50645 |
vulnerable | 2026-07-29 00:57:48.631632 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50634 |
vulnerable | 2026-07-29 00:57:48.617974 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50633 |
vulnerable | 2026-07-29 00:57:48.617769 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50632 |
vulnerable | 2026-07-29 00:57:48.617655 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50631 |
vulnerable | 2026-07-29 00:57:48.617534 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50630 |
vulnerable | 2026-07-29 00:57:48.617408 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50629 |
vulnerable | 2026-07-29 00:57:48.617186 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50628 |
vulnerable | 2026-07-29 00:57:48.617050 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50627 |
vulnerable | 2026-07-29 00:57:48.616901 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50623 |
vulnerable | 2026-07-29 00:57:48.616614 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49875 |
vulnerable | 2026-07-29 00:57:45.738299 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44930 |
vulnerable | 2026-06-08 08:05:11.384054 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44618 |
vulnerable | 2026-06-08 08:05:11.222364 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44417 |
vulnerable | 2026-06-08 08:05:11.049748 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48913 |
vulnerable | 2026-06-08 07:29:12.227780 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48795 |
vulnerable | 2026-06-08 07:29:11.402497 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23184 |
vulnerable | 2026-06-08 07:10:55.296538 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41172 |
vulnerable | 2026-06-08 06:43:54.244906 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32007 |
vulnerable | 2026-06-08 06:35:32.619278 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29736 |
vulnerable | 2026-06-08 06:33:29.262532 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28752 |
vulnerable | 2026-06-08 06:33:27.192215 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46364 |
vulnerable | 2026-06-08 05:50:38.731728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46363 |
vulnerable | 2026-06-08 05:50:38.730214 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30468 |
vulnerable | 2026-06-08 05:31:51.050480 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22696 |
vulnerable | 2026-06-08 05:30:01.077984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13954 |
vulnerable | 2026-06-08 05:18:01.601663 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8039 |
vulnerable | 2026-06-08 05:12:05.124676 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5656 |
vulnerable | 2026-06-08 05:09:47.773627 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5653 |
vulnerable | 2026-06-08 05:09:47.762302 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-3156 |
vulnerable | 2026-06-08 05:09:26.679236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12624 |
vulnerable | 2026-06-08 05:08:47.399419 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8739 |
vulnerable | 2026-06-08 05:08:14.753067 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6812 |
vulnerable | 2026-06-08 05:08:11.023376 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.