Apache CXF: JPA authorization-code consume is non-atomic

Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'

Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

Apache CXF: XML Signature wrapping in JAX-RS XML Security

Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

Apache CXF: FIQL Query Parser Denial of Service

Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

Apache CXF: XXE via WSDL/XSD import parsing

Apache CXF: Denial of service via message header attachments

Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF: Denial of Service attack via large attachments

Apache CXF: No restriction on attachment headers per message

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be…

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage…

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying…

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration

Bypass of the secureValidation property

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an…

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured…

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens…

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be…

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token…

Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing