Apache Software Foundation vulnerabilities and threats

A heap-based buffer overflow vulnerability exists in the Apache Portable Runtime Utility memcached client affecting versions from 1.3.0 through 1.6.3. This vulnerability can cause a denial of service due to application crashes. The issue is classified under CWE-122 and has a CVSS v3.1 base score of 7.5, indicating high severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-57818 is a high-severity race condition vulnerability in Apache CXF's JCacheCodeDataProvider component. It allows an attacker to redeem a single authorization code multiple times through concurrent requests, resulting in multiple valid access tokens being issued. This flaw can lead to unauthorized access and potential privilege escalation. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.

Apache CXF's OAuth2 Dynamic Client Registration endpoint improperly accepts and stores the 'scope' parameter from client registration requests without validating it against an allowlist. This allows clients to self-assign privileged scopes during registration. The issue affects multiple versions prior to 3.6.12, 4.1.8, and 4.2.3. Users are advised to upgrade to these fixed versions to mitigate the vulnerability.

Apache CXF contains a vulnerability in its JwtRequestCodeFilter where security-sensitive parameters from a signed JWT are copied into the authorization parameter map without proper exclusion. This allows an attacker who can produce a validly-signed JWT (for example, if the client_secret is compromised) to substitute critical parameters such as code_challenge, code_challenge_method, nonce, and state, undermining PKCE integrity and OpenID Connect replay protection. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 contain a vulnerability in the OIDC relying-party token validation process. This flaw allows acceptance of self-issued ID tokens without enforcing critical claim checks such as issuer, subject, audience, time, and sub_jwk binding, potentially enabling authentication bypass with crafted tokens. By default, self-issued ID tokens are not accepted, mitigating some risk. Upgrading to versions 4.2.3, 4.1.8, or 3.6.12 addresses this issue.

CVE-2026-68079 is a critical authentication bypass vulnerability in Apache CXF's DefaultEncryptingCodeDataProvider. The flaw allows a captured authorization code to be redeemed multiple times, violating the RFC requirement that authorization codes must only be used once. This issue affects multiple versions of Apache CXF prior to 4.2.3, 4.1.8, and 3.6.12, which contain the fixes.

Apache CXF's DefaultEncryptingOAuthDataProvider improperly handles revoked access and refresh tokens, allowing them to decrypt successfully and report as active via TokenIntrospectionService. This behavior violates RFC requirements that revoked tokens must be invalidated and introspection must return active:false. The issue affects multiple versions prior to fixed releases. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12 where the problem is resolved.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 are vulnerable to an XML External Entity (XXE) attack due to improper restriction of XML external entity references in imported WSDL/XSD documents. While the top-level WSDL is processed securely with external entities disabled, imported documents are handled by WSDL4J, which does not disable these features, exposing the system to potential information disclosure. This vulnerability is identified as CWE-611 and has a CVSS score of 7.5, indicating high severity. Users are advised to upgrade to fixed versions 4.2.3, 4.1.8, or 3.6.12 to mitigate the risk.

CVE-2026-57817 is a high-severity vulnerability in Apache CXF related to improper input validation of the c_hash parameter in OpenID Connect Hybrid Flow. If an Apache CXF relying party (RP) integrates with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP is vulnerable to authorization code substitution or injection attacks. Fixed versions include 4.2.3, 4.1.8, and 3.6.12.

Apache CXF's JMS transport component is vulnerable to deserialization of untrusted data via JMS ObjectMessage bodies. This vulnerability allows an attacker who can send messages to the JMS destination to submit malicious serialized objects, potentially causing denial of service or remote code execution if a suitable gadget class is present. The issue is fixed by disabling ObjectMessage deserialization by default and providing a configuration option to re-enable it if necessary. Users should upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12 to address this vulnerability.

CVE-2026-64958 is a denial of service vulnerability in Apache CXF caused by an incomplete fix for a previous issue (CVE-2026-50645). The flaw allows attackers to exhaust resources by sending messages with many attachment headers. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 do not set a default limit on the number of form parameters in JAX-RS messages. This lack of a default limit can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions when processing requests with very large numbers of form parameters. The issue is addressed by introducing a default limit of 500 parameters in the fixed versions.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 do not impose a default limit on the maximum attachment size, which can lead to denial of service (DoS) attacks if users do not explicitly configure this limit. The issue is addressed by setting a default attachment size limit of 50MB in the fixed versions.

Apache Polaris contains an authorization flaw where storage locations supplied during table and view registration are not consistently validated. An authenticated user with table or view registration permissions could cause Polaris to read an Iceberg metadata file outside the allowed storage boundaries if the catalog's storage credentials permit it. This could lead to limited confidential information disclosure. No unauthorized data modification or availability impact has been demonstrated. Exploitation requires specific deployment conditions including S3 credential vending and appropriate permissions.

CVE-2026-60053 is a critical vulnerability in Apache Answer versions prior to 2.0.2. It involves insufficient session expiration where administrative API keys remain valid even after the associated administrator account is demoted, suspended, marked inactive, or deleted. This flaw allows continued unauthorized access until the keys are explicitly removed. The issue is resolved in Apache Answer version 2.0.2.

CVE-2026-60023 is a high-severity vulnerability in Apache Answer versions prior to 2.0.2. It allows unauthorized users to retrieve deleted or pending answers through the single-answer read path if the parent question remains visible, exposing sensitive information that should not be accessible. The issue is fixed in version 2.0.2.

CVE-2026-50749 is an improper authorization vulnerability in Apache Answer affecting versions prior to 2.0.2. Authenticated users without review permissions can reject arbitrary pending edit-revisions due to a missing authorization check. The issue is fixed in version 2.0.2.

CVE-2026-48912 is an improper input validation vulnerability in Apache Answer up to version 2.0.1. The flaw allows any authenticated user to delete other users' uploaded files by exploiting a missing ownership check in the avatar-cleanup logic. The issue is fixed in version 2.0.2.

CVE-2026-48911 is a high-severity vulnerability in Apache Answer up to version 2.0.1. It involves a missing authorization check in the external-login email binding flow, allowing unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. The issue is fixed in version 2.0.2.