FAIL › dossier
cxf
PRODUCT· dossier confidence 50%
Apache CXF is a Java web services framework with a critical security track record, featuring multiple high-severity vulnerabilities in 2026 including LDAP injection, JWT audience validation bypasses, and unhardened XML parsing leading to out-of-band attacks.
PROFILE
Categorysoftware libraryWhat they doApache CXF is a Java-based web services framework that provides implementations for JAX-WS, JAX-RS, and other web service standards.
SECURITY POSTURE
The library has a critical security track record with multiple high-severity vulnerabilities in 2026, including LDAP injection, JWT audience validation bypasses, IP-based access control logic errors, and unhardened XML parsing leading to OOB attacks.
Notable failures
- CVE-2026-49875: Unhardened SAXParserFactory enabling OOB attacks
- CVE-2026-50627: JWT audience validation bypass
- CVE-2026-50628: IP-based access control logic error
- CVE-2026-44930: LDAP injection in XKMS certificate repository
Patterns: critical XML parsing vulnerabilities; JWT validation bypasses; LDAP injection flaws; IP-based access control logic errors
FAILURE HISTORY · 4
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-06-12 | CVE-2026-49875 | critical | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix t |
| 2026-06-12 | CVE-2026-50627 | critical | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Rou |
| 2026-06-12 | CVE-2026-50628 | critical | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to v |
| 2026-05-22 | CVE-2026-44930 | critical | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. |
Open questions: Apache CXF's exact founding year and headquarters location are not explicitly stated in the provided evidence and must be inferred from general knowledge, which violates the instruction to work from ONLY the supplied evidence.
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-21 04:44:50.037818+00:00