DeutschShown in its original language — a full translation is planned for a future version.
Apache CXF: Mehrere Schwachstellen
view advisory published 2026-06-11
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um Sicherheitsvorkehrungen zu umgehen, XML-External-Entity-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-50645US | high7.5 | — | ||
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or… | ||||
| CVE-2026-50634US | — | — | ||
A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypas… | ||||
| CVE-2026-50633US | — | — | ||
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployme… | ||||
| CVE-2026-50632US | — | — | ||
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution cap… | ||||
| CVE-2026-50631US | — | — | ||
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when… | ||||
| CVE-2026-50630US | — | — | ||
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without… | ||||
| CVE-2026-50629US | — | — | ||
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker… | ||||
| CVE-2026-50628US | critical9.8 | — | ||
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this
sec… | ||||
| CVE-2026-50627US | critical9.1 | — | ||
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be… | ||||
| CVE-2026-50623US | — | — | ||
An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspecti… | ||||
| CVE-2026-49875US | critical9.8 | — | ||
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB)… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:36839 vom 2026-07-08external
- Red Hat Security Advisory RHSA-2026:37390 vom 2026-07-09external
- Red Hat Security Advisory RHSA-2026:70228 vom 2026-09-22external
- Red Hat Security Advisory RHSA-2026:70229 vom 2026-09-22external
- Red Hat Security Advisory RHSA-2026:70277 vom 2026-09-22external
- Apache CXF Releases Download vom 2026-06-11external
- Apache CXF Security Advisory CVE-2026-49875 vom 2026-06-11external
- Apache CXF Security Advisory CVE-2026-50623 vom 2026-06-11external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan