Threats affecting pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-core

Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 have a vulnerability where StaxUtils does not limit the total number of XML elements or characters by default. This can lead to excessive memory and CPU usage during XML parsing, potentially causing a denial of service. The issue is fixed by introducing default limits on element count and document size in the specified versions.

Apache CXF contains a vulnerability in its multipart/MTOM attachment part header parser where configured limits on header size and count are not fully enforced. This allows a remote unauthenticated attacker to send specially crafted multipart requests with very large folded or repeated headers, causing unbounded memory allocation and resulting in a denial of service. Versions prior to 4.2.4, 4.1.9, and 3.6.13 are affected. Upgrading to these fixed versions mitigates the issue.

CVE-2026-78384 is a high-severity vulnerability in Apache CXF where the CompressionUtils.inflate() method decompresses attacker-controlled DEFLATE data without limiting the output size. This can cause a small crafted payload to expand to gigabytes on the heap, potentially leading to resource exhaustion. The flaw is exploitable via JWE decryption with zip=DEF and SAML redirect/POST binding token inflation, both occurring before trust validation. Fixed versions include 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable maximum inflated-size cap to prevent excessive memory usage.

CVE-2026-64958 is a denial of service vulnerability in Apache CXF caused by an incomplete fix for a previous issue (CVE-2026-50645). The flaw allows attackers to exhaust resources by sending messages with many attachment headers. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 do not impose a default limit on the maximum attachment size, which can lead to denial of service (DoS) attacks if users do not explicitly configure this limit. The issue is addressed by setting a default attachment size limit of 50MB in the fixed versions.

CVE-2026-49875 is an information disclosure vulnerability in Apache CXF caused by improper XML parser configuration that allows out-of-band external entity resolution. This flaw affects the EndpointReferenceUtils and W3CMultiSchemaFactory classes, enabling remote attackers to disclose sensitive information without user interaction. The vulnerability is addressed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Red Hat products bundling Apache CXF are also affected, but currently no effective mitigation or fix meeting Red Hat's criteria is available for those products.

Apache CXF versions prior to 4.1.7, 4.2.2, and 3.6.12 allow an unlimited number of attachment headers during message deserialization. This lack of restriction can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions. The issue is addressed by imposing a default maximum of 500 attachments per message in the fixed versions.

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

CVE-2026-44618 is a medium severity vulnerability in Apache CXF's WS-Transfer module caused by insecure XML parser configuration that allows XML External Entity (XXE) attacks. This vulnerability affects Apache CXF versions 4.2.0 and 4.0.0. The issue is addressed in Apache CXF versions 4.2.1, 4.1.

Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted. Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).