Apache Cxf
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Cxf (f5730434-77f3-59e0-a167-672dce7921cd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-50645 |
vulnerable | 2026-07-29 00:57:48.631632 |
Apache CXF: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.
Published: 2026-06-12T09:06:54.819Z
Updated: 2026-06-12T13:43:27.552Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50634 |
vulnerable | 2026-07-29 00:57:48.617974 |
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption
that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
Published: 2026-06-12T09:05:53.768Z
Updated: 2026-06-12T15:10:21.356Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50633 |
vulnerable | 2026-07-29 00:57:48.617769 |
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Published: 2026-06-12T09:02:02.547Z
Updated: 2026-07-15T00:46:31.266Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50632 |
vulnerable | 2026-07-29 00:57:48.617655 |
Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Published: 2026-06-12T09:00:48.530Z
Updated: 2026-07-15T00:46:33.578Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50631 |
vulnerable | 2026-07-29 00:57:48.617534 |
Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Published: 2026-06-12T08:59:40.200Z
Updated: 2026-06-12T14:04:22.866Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50630 |
vulnerable | 2026-07-29 00:57:48.617408 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50629 |
vulnerable | 2026-07-29 00:57:48.617186 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50628 |
vulnerable | 2026-07-29 00:57:48.617050 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50627 |
vulnerable | 2026-07-29 00:57:48.616901 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50623 |
vulnerable | 2026-07-29 00:57:48.616614 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49875 |
vulnerable | 2026-07-29 00:57:45.738299 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44930 |
vulnerable | 2026-06-08 08:05:11.384054 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44618 |
vulnerable | 2026-06-08 08:05:11.222364 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44417 |
vulnerable | 2026-06-08 08:05:11.049748 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48913 |
vulnerable | 2026-06-08 07:29:12.227780 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48795 |
vulnerable | 2026-06-08 07:29:11.402497 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23184 |
vulnerable | 2026-06-08 07:10:55.296538 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41172 |
vulnerable | 2026-06-08 06:43:54.244906 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32007 |
vulnerable | 2026-06-08 06:35:32.619278 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29736 |
vulnerable | 2026-06-08 06:33:29.262532 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28752 |
vulnerable | 2026-06-08 06:33:27.192215 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46364 |
vulnerable | 2026-06-08 05:50:38.731728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46363 |
vulnerable | 2026-06-08 05:50:38.730214 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30468 |
vulnerable | 2026-06-08 05:31:51.050480 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22696 |
vulnerable | 2026-06-08 05:30:01.077984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13954 |
vulnerable | 2026-06-08 05:18:01.601663 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8039 |
vulnerable | 2026-06-08 05:12:05.124676 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5656 |
vulnerable | 2026-06-08 05:09:47.773627 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5653 |
vulnerable | 2026-06-08 05:09:47.762302 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-3156 |
vulnerable | 2026-06-08 05:09:26.679236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12624 |
vulnerable | 2026-06-08 05:08:47.399419 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-8739 |
vulnerable | 2026-06-08 05:08:14.753067 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6812 |
vulnerable | 2026-06-08 05:08:11.023376 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.