# org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) vulnerabilities 5 known vulnerabilities (1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.4 (Oct 1, 2026): no advisory affects it - Newest unaffected release: 4.2.4 (Oct 1, 2026), the latest release - Dependents: 197 - Releases: 227 since 2.1 (Apr 28, 2008) - Registry: https://central.sonatype.com/artifact/org.apache.cxf/cxf-rt-frontend-jaxrs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-57819: 2.1 to 3.6.11 (3.6.12 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it) - CVE-2014-3584: 2.5.0 to 2.6.10 (2.6.11 is outside it); 2.7.0 to 2.7.7 (2.7.8 is outside it); 3.0.0 (3.0.1 is outside it) - CVE-2013-2160: 2.5.0 to 2.5.9 (2.5.10 is outside it); 2.6.0 to 2.6.6 (2.6.7 is outside it); 2.7.0 to 2.7.3 (2.7.4 is outside it) - CVE-2013-0239: 2.1 to 2.5.8 (2.5.9 is outside it); 2.6.0 to 2.6.5 (2.6.6 is outside it); 2.7.0 to 2.7.2 (2.7.3 is outside it) - CVE-2010-2076: 2.1 to 2.1.9 (2.1.10 is outside it); 2.2 to 2.2.8 (2.2.9 is outside it) ## Advisories (5) ### [CVE-2026-57819](https://cve.now/CVE-2026-57819): Apache CXF: No default restriction on the amount of form parameters per message - Severity: High 7.5 - Published: Aug 6, 2026 - Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12. - Fixed in 3.6.12 (released Jul 30, 2026, 7 days before disclosure), 4.1.8 (released Jul 30, 2026, 7 days before disclosure) and 4.2.3 (released Jul 30, 2026, 7 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2014-3584](https://cve.now/CVE-2014-3584): The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial… - Severity: Unrated - Published: Oct 30, 2014 - Affected: from 2.5.0, fixed in 2.6.11; from 2.7.0, fixed in 2.7.8; from 3.0.0, fixed in 3.0.1. - Fixed in 2.6.11 (released Nov 19, 2013, 345 days before disclosure), 2.7.8 (released Nov 20, 2013, 344 days before disclosure) and 3.0.1 (released Jul 15, 2014, 107 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2013-2160](https://cve.now/CVE-2013-2160): The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a… - Severity: Unrated - Published: Aug 19, 2013 - Affected: from 2.5.0, fixed in 2.5.10; from 2.6.0, fixed in 2.6.7; from 2.7.0, fixed in 2.7.4. - Fixed in 2.5.10 (released Mar 28, 2013, 144 days before disclosure), 2.6.7 (released Mar 28, 2013, 144 days before disclosure) and 2.7.4 (released Mar 28, 2013, 144 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2013-0239](https://cve.now/CVE-2013-0239): Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows… - Severity: Unrated - Published: Mar 12, 2013 - Affected: fixed in 2.5.9; from 2.6.0, fixed in 2.6.6; from 2.7.0, fixed in 2.7.3. - Fixed in 2.5.9 (released Jan 28, 2013, 43 days before disclosure), 2.6.6 (released Jan 28, 2013, 43 days before disclosure) and 2.7.3 (released Jan 29, 2013, 42 days before disclosure). - The latest release, 4.2.4, is not affected. ### [CVE-2010-2076](https://cve.now/CVE-2010-2076): Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry… - Severity: Unrated - Published: Aug 19, 2010 - Affected: from 2.0.0, fixed in 2.0.13; from 2.1.0, fixed in 2.1.10; from 2.2.0, fixed in 2.2.9. - Fixed in 2.1.10 (released Jun 1, 2010, 79 days before disclosure, the advisory names 2.0.13, which was never published) and 2.2.9 (released Jun 2, 2010, 78 days before disclosure). - The latest release, 4.2.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.cxf:cxf-rt-frontend-jaxrs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.