DeutschShown in its original language — a full translation is planned for a future version.
Apache CXF: Mehrere Schwachstellen
view advisory published 2026-08-05
Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-68481US | — | — | ||
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh… | ||||
| CVE-2026-68079US | —OT elevated | — | ||
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeG… | ||||
| CVE-2026-65583US | —OT elevated | — | ||
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enab… | ||||
| CVE-2026-63687US | —OT elevated | — | ||
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that ca… | ||||
| CVE-2026-61466US | — | — | ||
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, wit… | ||||
| CVE-2026-57818US | — | — | ||
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple di… | ||||
| CVE-2026-66909US | — | — | ||
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place… | ||||
| CVE-2026-65432US | — | — | ||
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from tha… | ||||
| CVE-2026-64958US | — | — | ||
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users ar… | ||||
| CVE-2026-57819US | — | — | ||
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which m… | ||||
| CVE-2026-57817US | — | — | ||
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-… | ||||
| CVE-2026-54225US | — | — | ||
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, me… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:71675 vom 2026-09-24external
- Red Hat Security Advisory RHSA-2026:83670 vom 2026-10-16external
- Apache CXF Security Advisories vom 2026-08-05external
- Apache CXF Security Advisories vom 2026-08-05external
- Apache CXF Security Advisories vom 2026-08-05external
- Apache CXF Security Advisories vom 2026-08-05external
- Apache CXF Security Advisories vom 2026-08-05external
- Apache CXF Security Advisories vom 2026-08-05external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan