CX
Product
Cxf
80
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 19High 31Medium 15Low 0
Watch
Add Cxf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50634 | 6.5 | Jun 12 | Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2026-50630 | 6.5 | Jun 12 | Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2019-12406 | 6.5 | Nov 6 | Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message Affected: before 3.2.11; 3.3.0 before 3.3.4 |
| CVE-2026-79650 | 6.1 | Oct 9 | Apache CXF: OIDC RP Open Redirect Affected: before 3.6.13; 4.0.0 before 4.1.9; 4.2.0 before 4.2.4 |
| CVE-2020-13954 | 6.1 | Nov 12 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: before 3.3.8; 3.4.0 before 3.4.1 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 3.2.0 through 3.2.12; 3.3.0 before 3.3.5 |
| CVE-2016-6812 | 6.1 | Aug 10 | The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL… Affected: through 3.0.11; 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; +4 more |
| CVE-2011-2487 | 5.9 | Mar 11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack Affected: 2.4.0 through 2.4.6; 2.5.0 through 2.5.2 |
| CVE-2025-48795 | 5.6 | Jul 15 | Apache CXF stores large stream based messages as temporary files on the local filesystem Affected: 3.5.10; 3.6.5; 4.0.6; 4.1.0 |
| CVE-2017-12624 | 5.5 | Nov 14 | Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications Affected: 3.0.0 before 3.0.16; 3.1.0 before 3.1.14; 3.2.0 before 3.2.1 |
| CVE-2026-50629 | 5.3 | Jun 12 | Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2026-44618 | 5.3 | May 22 | Apache CXF: XXE vulnerability in WS-Transfer functionality Affected: before 3.6.11; 4.0.0 before 4.1.6; 4.2.0 |
| CVE-2020-1954 | 5.3 | Apr 1 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus Affected: before 3.2.13; 3.3.0 before 3.3.6 |
| CVE-2017-5653 | 5.3 | Apr 18 | JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to… Affected: 3.0.0 through 3.0.13; 3.1.0 through 3.1.11 |
| CVE-2026-50623 | 4.8 | Jun 12 | Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2015-5253 | – | Nov 18 | The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML… Affected: before 2.7.18; 3.0.0 before 3.0.7; 3.1.0 before 3.1.3 |
| CVE-2014-3623 | – | Oct 30 | Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML… Affected: 2.7.0 through 2.7.13; 3.0.0 before 3.0.2 |
| CVE-2014-3584 | – | Oct 30 | The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted… Affected: through 2.6.10; 2.6.1; 2.7.0; 2.7.1; 2.7.2; 2.7.3; +5 more |
| CVE-2014-0035 | – | Jul 7 | The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken,… Affected: through 2.6.12; 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; +17 more |
| CVE-2014-0034 | – | Jul 7 | The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to… Affected: through 2.6.11; 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; +15 more |
| CVE-2014-0110 | – | May 8 | Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message Affected: through 2.6.13; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +34 more |
| CVE-2014-0109 | – | May 8 | Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to… Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +34 more |
| CVE-2013-2160 | – | Aug 19 | The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +15 more |
| CVE-2012-5575 | – | Aug 19 | Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +15 more |
| CVE-2013-0239 | – | Mar 12 | Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass… Affected: through 2.5.8; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +20 more |
| CVE-2012-5633 | – | Mar 12 | The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows… Affected: through 2.5.7; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +9 more |
| CVE-2012-2378 | – | Jan 5 | Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the… Affected: 2.4.5; 2.4.6; 2.4.7; 2.5.1; 2.5.2; 2.5.3; +1 more |
| CVE-2012-2379 | – | Jan 3 | Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +7 more |
| CVE-2012-5786 | – | Nov 4 | The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a… Affected: through 2.6.17 |
| CVE-2012-3451 | – | Sep 24 | Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action… Affected: before 2.4.9; 2.5.0 before 2.5.5; 2.6.0 before 2.6.2 |