This vulnerability in Apache CXF involves improper neutralization of CRLF sequences (CWE-113) in the construction of the WWW-Authenticate HTTP response header within the OAuth2 AuthorizationUtils class. The 'realm' parameter is concatenated directly without sanitization of CR and LF characters, enabling an attacker with control over this parameter to perform HTTP response splitting or inject arbitrary HTTP headers. The vulnerability affects versions =4.2.0, >=4.2.0 <4.2.2, and <4.1.7. The vendor has addressed the issue in versions 4.2.2 and 4.1.7. No CVSS score or official remediation level is provided in the advisory data.

Successful exploitation allows an attacker to inject arbitrary HTTP headers or split the HTTP response, which can lead to web cache poisoning, cross-site scripting, or other HTTP header injection attacks. This can compromise the integrity of HTTP responses and potentially impact client security. No known exploits have been reported in the wild at this time.

Users should upgrade affected Apache CXF versions to 4.2.2 or 4.1.7, where this vulnerability has been fixed. Patch status is confirmed by the vendor advisory recommending these versions. No other mitigation or temporary fixes are indicated.