CX
Product
Cxf
80
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 19High 31Medium 15Low 0
Watch
Add Cxf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50634 | 6.5 | Jun 12 | Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2026-50630 | 6.5 | Jun 12 | Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2019-12406 | 6.5 | Nov 6 | Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message Affected: before 3.2.11; 3.3.0 before 3.3.4 |
| CVE-2026-79650 | 6.1 | Oct 9 | Apache CXF: OIDC RP Open Redirect Affected: before 3.6.13; 4.0.0 before 4.1.9; 4.2.0 before 4.2.4 |
| CVE-2020-13954 | 6.1 | Nov 12 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: before 3.3.8; 3.4.0 before 3.4.1 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 3.2.0 through 3.2.12; 3.3.0 before 3.3.5 |
| CVE-2016-6812 | 6.1 | Aug 10 | The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL… Affected: through 3.0.11; 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; +4 more |
| CVE-2011-2487 | 5.9 | Mar 11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack Affected: 2.4.0 through 2.4.6; 2.5.0 through 2.5.2 |
| CVE-2025-48795 | 5.6 | Jul 15 | Apache CXF stores large stream based messages as temporary files on the local filesystem Affected: 3.5.10; 3.6.5; 4.0.6; 4.1.0 |
| CVE-2017-12624 | 5.5 | Nov 14 | Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications Affected: 3.0.0 before 3.0.16; 3.1.0 before 3.1.14; 3.2.0 before 3.2.1 |
| CVE-2026-50629 | 5.3 | Jun 12 | Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2026-44618 | 5.3 | May 22 | Apache CXF: XXE vulnerability in WS-Transfer functionality Affected: before 3.6.11; 4.0.0 before 4.1.6; 4.2.0 |
| CVE-2020-1954 | 5.3 | Apr 1 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus Affected: before 3.2.13; 3.3.0 before 3.3.6 |
| CVE-2017-5653 | 5.3 | Apr 18 | JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to… Affected: 3.0.0 through 3.0.13; 3.1.0 through 3.1.11 |
| CVE-2026-50623 | 4.8 | Jun 12 | Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService Affected: before 4.1.7; 4.2.0 before 4.2.2 |
Showing 15