What’s Vulnerable › Products

Apache Software Foundation Apache CXF vulnerabilities

80 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 40 published in the last 12 months.

Check whether your Apache Software Foundation Apache CXF version is affected

Latest Apache Software Foundation Apache CXF vulnerabilities

• CVE-2026-97791 — Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests (CVSS 7.5)
• CVE-2026-97468 — Apache CXF: Authentication bypass via weak cache keys for validated STS tokens (CVSS 9.1)
• CVE-2026-86463 — Apache CXF: FIQL Query Parser Denial of Service (CVSS 7.5)
• CVE-2026-79650 — Apache CXF: OIDC RP Open Redirect (CVSS 6.1)
• CVE-2026-78384 — Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) (CVSS 7.5)
• CVE-2026-73179 — Apache CXF: JPA authorization-code consume is non-atomic (CVSS 8.1)
• CVE-2026-71575 — Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter (CVSS 9.1)
• CVE-2026-108039 — Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits (CVSS 7.5)
• CVE-2026-107938 — Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. (CVSS 9.1)
• CVE-2026-107937 — Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. (CVSS 7.5)
• CVE-2026-100227 — Apache CXF: XML Signature wrapping in JAX-RS XML Security (CVSS 7.5)
• CVE-2026-68481 — Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider (CVSS 7.5)
• CVE-2026-68079 — Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay (CVSS 9.8)
• CVE-2026-65583 — Apache CXF: Self-issued ID token claims validation skipped (CVSS 9.1)
• CVE-2026-63687 — Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters (CVSS 9.1)
• CVE-2026-61466 — Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation (CVSS 9.1)
• CVE-2026-57818 — Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider (CVSS 8.1)
• CVE-2026-66909 — Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage (CVSS 9.8)
• CVE-2026-65432 — Apache CXF: XXE via WSDL/XSD import parsing (CVSS 7.5)
• CVE-2026-64958 — Apache CXF: Denial of service via message header attachments (CVSS 7.5)
• CVE-2026-57819 — Apache CXF: No default restriction on the amount of form parameters per message (CVSS 7.5)
• CVE-2026-57817 — Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow (CVSS 8.1)
• CVE-2026-54225 — Apache CXF: Denial of Service attack via large attachments (CVSS 7.5)
• CVE-2026-50645 — Apache CXF: No restriction on attachment headers per message (CVSS 7.5)
• CVE-2026-50634 — Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry (CVSS 6.5)