JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypt

Summary

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

Timeline

1. Apr 18, 2017, 4:00 PM UTCCVE published
2. Aug 5, 2024, 3:11 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache CXF

  prior to 3.0.13, 3.1.x prior to 3.1.11

• org.apache.cxf:cxf-coreMaven

  From 3.1.0 · fixed in 3.1.11

• org.apache.cxf:cxf-coreMaven

  fixed in 3.0.13

References 10