# org.apache.myfaces.core:myfaces-impl (Maven) vulnerabilities

3 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 4.1.4 (Sep 2, 2026): no advisory affects it
- Newest unaffected release: 4.1.4 (Sep 2, 2026), the latest release
- Dependents: 16
- Releases: 133 since 1.1.2 (Jun 21, 2006)
- Registry: https://central.sonatype.com/artifact/org.apache.myfaces.core/myfaces-impl
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-68536: 2.2.0-beta to 2.2.15 (2.3.0-beta is outside it); 2.3.0 to 2.3-next-M8 (2.3-next-M9 is outside it); 2.3.1 to 2.3.11 (2.3.12 is outside it); 3.0.0 to 3.0.3 (3.0.4 is outside it); 4.0.0 to 4.0.3 (4.0.4 is outside it); 4.1.0 to 4.1.3 (4.1.4 is outside it)
- CVE-2011-4367: 2.0.0 to 2.0.11 (2.0.12 is outside it); 2.1.0 to 2.1.5 (2.1.6 is outside it)
- CVE-2010-2057: 1.1.2 to 1.1.7 (1.1.8 is outside it); 1.2.0 to 1.2.8 (1.2.9 is outside it); 2.0.0 (2.0.1 is outside it)

## Advisories (3)

### [CVE-2026-68536](https://cve.now/CVE-2026-68536): Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

- Severity: Critical 9.8
- Published: Sep 16, 2026
- Affected: from 2.2.0-beta, through 2.2.15; from 2.3-next-M1, fixed in 2.3-next-M9; from 2.3.1, fixed in 2.3.12; from 3.0.0, fixed in 3.0.4; from 4.0.0, fixed in 4.0.4; from 4.1.0, fixed in 4.1.4.
- Fixed in 2.3-next-M9 (released Sep 1, 2026, 15 days before disclosure), 2.3.12 (released Sep 1, 2026, 15 days before disclosure), 3.0.4 (released Sep 1, 2026, 15 days before disclosure) and 2 other versions.
- The latest release, 4.1.4, is not affected.

### [CVE-2011-4367](https://cve.now/CVE-2011-4367): Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before…

- Severity: Unrated
- Published: Jun 19, 2014
- Affected: from 2.0.0, fixed in 2.0.12; from 2.1.0, fixed in 2.1.6.
- Fixed in 2.0.12 (released Feb 3, 2012, 867 days before disclosure) and 2.1.6 (released Feb 3, 2012, 867 days before disclosure).
- The latest release, 4.1.4, is not affected.

### [CVE-2010-2057](https://cve.now/CVE-2010-2057): shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State…

- Severity: Unrated
- Published: Oct 20, 2010
- Affected: from 1.1.0, fixed in 1.1.8; from 1.2.0, fixed in 1.2.9; from 2.0.0, fixed in 2.0.1.
- Fixed in 1.1.8 (released Jun 10, 2010, 132 days before disclosure), 1.2.9 (released Jun 10, 2010, 132 days before disclosure) and 2.0.1 (released Jul 18, 2010, 94 days before disclosure).
- The latest release, 4.1.4, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.myfaces.core:myfaces-impl
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.