CVE-2026-50630: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in Apache Software Foundation Apache CXF
CVE-2026-50630 is a CRLF injection vulnerability in Apache CXF's OAuth2 AuthorizationUtils class. The vulnerability occurs because the 'realm' parameter in the WWW-Authenticate response header is concatenated without sanitizing carriage return and line feed characters. This allows an attacker controlling the realm value to inject arbitrary HTTP headers or split the HTTP response. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-50630) involves improper neutralization of CRLF sequences (CWE-113) in the OAuth2 AuthorizationUtils class of Apache CXF. Specifically, when constructing the WWW-Authenticate HTTP response header, the 'realm' parameter is concatenated without sanitizing CR and LF characters, enabling an attacker with control over the realm value to perform HTTP response splitting or inject arbitrary headers. The vulnerability affects multiple versions of Apache CXF prior to 4.2.2, 4.1.7, and 3.6.12, where the issue has been fixed.
Potential Impact
An attacker able to control the 'realm' parameter in the WWW-Authenticate header can inject arbitrary HTTP headers or split the HTTP response. This can lead to HTTP response splitting attacks, potentially enabling cache poisoning, cross-site scripting (XSS), or other injection-based attacks. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality and integrity but not availability.
Mitigation Recommendations
Users should upgrade Apache CXF to versions 4.2.2, 4.1.7, or 3.6.12 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor advisory stating these versions address the issue.
CVE-2026-50630: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in Apache Software Foundation Apache CXF
Description
CVE-2026-50630 is a CRLF injection vulnerability in Apache CXF's OAuth2 AuthorizationUtils class. The vulnerability occurs because the 'realm' parameter in the WWW-Authenticate response header is concatenated without sanitizing carriage return and line feed characters. This allows an attacker controlling the realm value to inject arbitrary HTTP headers or split the HTTP response. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12.
CVSS v3.1
Score 6.5medium
Affected software
Apache Software Foundation
Apache CXF
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-rs-security-oauth2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-50630) involves improper neutralization of CRLF sequences (CWE-113) in the OAuth2 AuthorizationUtils class of Apache CXF. Specifically, when constructing the WWW-Authenticate HTTP response header, the 'realm' parameter is concatenated without sanitizing CR and LF characters, enabling an attacker with control over the realm value to perform HTTP response splitting or inject arbitrary headers. The vulnerability affects multiple versions of Apache CXF prior to 4.2.2, 4.1.7, and 3.6.12, where the issue has been fixed.
Potential Impact
An attacker able to control the 'realm' parameter in the WWW-Authenticate header can inject arbitrary HTTP headers or split the HTTP response. This can lead to HTTP response splitting attacks, potentially enabling cache poisoning, cross-site scripting (XSS), or other injection-based attacks. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality and integrity but not availability.
Mitigation Recommendations
Users should upgrade Apache CXF to versions 4.2.2, 4.1.7, or 3.6.12 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor advisory stating these versions address the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-05T10:57:56.617Z
- State
- PUBLISHED
Threat ID: 6a2bd75fe617e2d83448bff6
Added to database: 06/12/2026, 09:54:39 UTC
Last enriched: 08/14/2026, 16:23:34 UTC
Last updated: 09/15/2026, 04:36:53 UTC
Views: 118
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.