- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 16 · 1 critical, 4 high, 3 medium
- Dependents
- 454
- Registry
- Maven Central
Advisories 16
- CVE-2026-64958High 7.5
Apache CXF: Denial of service via message header attachments
Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12.
- CVE-2026-54225High 7.5
Apache CXF: Denial of Service attack via large attachments
Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12.
- CVE-2026-50645High 7.5
Apache CXF: No restriction on attachment headers per message
Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12.
- CVE-2026-49875Medium 6.5
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12.
- CVE-2025-48795Medium 5.6
Apache CXF: Denial of Service and sensitive data exposure in logs
Affected: fixed in 3.5.11; from 3.6.0, fixed in 3.6.6; from 4.0.0, fixed in 4.0.7; from 4.1.0, fixed in 4.1.1.
- CVE-2025-23184Medium 5.9
Apache CXF: Denial of Service vulnerability with temporary files
Affected: fixed in 3.5.10; from 3.6.0, fixed in 3.6.5; from 4.0.0, fixed in 4.0.6.
- CVE-2022-46364Critical 9.8
Apache CXF SSRF Vulnerability
Affected: fixed in 3.4.10; from 3.5.0, fixed in 3.5.5.
- CVE-2022-46363High 7.5
Apache CXF directory listing / code exfiltration
Affected: fixed in 3.4.10; from 3.5.0, fixed in 3.5.5.
- CVE-2017-12624Unrated
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications.
Affected: from 3.2.0, fixed in 3.2.1; from 3.1.0, fixed in 3.1.14; fixed in 3.0.16.
- CVE-2016-8739Unrated
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders.
Affected: fixed in 3.0.12; from 3.1.0, fixed in 3.1.9.
- CVE-2016-6812Unrated
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page…
Affected: fixed in 3.0.12; from 3.1.0, fixed in 3.1.9.
- CVE-2017-5656Unrated
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which…
Affected: from 3.1.0, fixed in 3.1.11; fixed in 3.0.13.
- CVE-2017-5653Unrated
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or…
Affected: from 3.1.0, fixed in 3.1.11; fixed in 3.0.13.
- CVE-2014-0035Unrated
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken…
Affected: fixed in 2.6.13; from 2.7.0, fixed in 2.7.10.
- CVE-2014-0110Unrated
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large…
Affected: fixed in 2.6.14; from 2.7.0, fixed in 2.7.11.
- CVE-2014-0109Unrated
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large…
Affected: fixed in 2.6.14; from 2.7.0, fixed in 2.7.11.