# org.apache.cxf:cxf-core (Maven) vulnerabilities 16 known vulnerabilities (1 critical, 4 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Dependents: 454 - Registry: https://central.sonatype.com/artifact/org.apache.cxf/cxf-core ## Advisories (16) ### [CVE-2026-64958](https://cve.now/CVE-2026-64958): Apache CXF: Denial of service via message header attachments - Severity: High 7.5 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. ### [CVE-2026-54225](https://cve.now/CVE-2026-54225): Apache CXF: Denial of Service attack via large attachments - Severity: High 7.5 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. ### [CVE-2026-50645](https://cve.now/CVE-2026-50645): Apache CXF: No restriction on attachment headers per message - Severity: High 7.5 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12. ### [CVE-2026-49875](https://cve.now/CVE-2026-49875): Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils - Severity: Medium 6.5 - Published: Jun 12, 2026 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12; from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.7; fixed in 3.6.12. ### [CVE-2025-48795](https://cve.now/CVE-2025-48795): Apache CXF: Denial of Service and sensitive data exposure in logs - Severity: Medium 5.6 - Published: Jul 15, 2025 - Affected: fixed in 3.5.11; from 3.6.0, fixed in 3.6.6; from 4.0.0, fixed in 4.0.7; from 4.1.0, fixed in 4.1.1. ### [CVE-2025-23184](https://cve.now/CVE-2025-23184): Apache CXF: Denial of Service vulnerability with temporary files - Severity: Medium 5.9 - Published: Jan 21, 2025 - Affected: fixed in 3.5.10; from 3.6.0, fixed in 3.6.5; from 4.0.0, fixed in 4.0.6. ### [CVE-2022-46364](https://cve.now/CVE-2022-46364): Apache CXF SSRF Vulnerability - Severity: Critical 9.8 - Published: Dec 13, 2022 - Affected: fixed in 3.4.10; from 3.5.0, fixed in 3.5.5. ### [CVE-2022-46363](https://cve.now/CVE-2022-46363): Apache CXF directory listing / code exfiltration - Severity: High 7.5 - Published: Dec 13, 2022 - Affected: fixed in 3.4.10; from 3.5.0, fixed in 3.5.5. ### [CVE-2017-12624](https://cve.now/CVE-2017-12624): Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. - Severity: Unrated - Published: Nov 14, 2017 - Affected: from 3.2.0, fixed in 3.2.1; from 3.1.0, fixed in 3.1.14; fixed in 3.0.16. ### [CVE-2016-8739](https://cve.now/CVE-2016-8739): The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. - Severity: Unrated - Published: Aug 10, 2017 - Affected: fixed in 3.0.12; from 3.1.0, fixed in 3.1.9. ### [CVE-2016-6812](https://cve.now/CVE-2016-6812): The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page… - Severity: Unrated - Published: Aug 10, 2017 - Affected: fixed in 3.0.12; from 3.1.0, fixed in 3.1.9. ### [CVE-2017-5656](https://cve.now/CVE-2017-5656): Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which… - Severity: Unrated - Published: Apr 18, 2017 - Affected: from 3.1.0, fixed in 3.1.11; fixed in 3.0.13. ### [CVE-2017-5653](https://cve.now/CVE-2017-5653): JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or… - Severity: Unrated - Published: Apr 18, 2017 - Affected: from 3.1.0, fixed in 3.1.11; fixed in 3.0.13. ### [CVE-2014-0035](https://cve.now/CVE-2014-0035): The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken… - Severity: Unrated - Published: Jul 7, 2014 - Affected: fixed in 2.6.13; from 2.7.0, fixed in 2.7.10. ### [CVE-2014-0110](https://cve.now/CVE-2014-0110): Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large… - Severity: Unrated - Published: May 8, 2014 - Affected: fixed in 2.6.14; from 2.7.0, fixed in 2.7.11. ### [CVE-2014-0109](https://cve.now/CVE-2014-0109): Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large… - Severity: Unrated - Published: May 8, 2014 - Affected: fixed in 2.6.14; from 2.7.0, fixed in 2.7.11. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.cxf:cxf-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.