Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style…

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other…

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take…

Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF: Self-issued ID token claims validation skipped

Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices

Apache CXF: JPA authorization-code consume is non-atomic

Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'

Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

Apache CXF: XML Signature wrapping in JAX-RS XML Security

Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

Apache CXF: FIQL Query Parser Denial of Service

Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

Apache CXF: XXE via WSDL/XSD import parsing

Apache CXF: Denial of service via message header attachments

Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF: Denial of Service attack via large attachments

Apache CXF: No restriction on attachment headers per message

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be…

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage…

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying…

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration

Bypass of the secureValidation property

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an…

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured…

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens…

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be…

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token…

Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing