GHSA-pg32-686q-qh6x

ghsaUSosv

Apache CXF has an LDAP injection vulnerability

view advisory published 2026-05-26Licence: CC-BY-4.0

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-44930US	critical9.8	0.72% (54th)	—	2026-05-22
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. U…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/05/22/9WEB
https://github.com/apache/cxfPACKAGE
https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkhWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-44930ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan