Threats tagged 'ghsa-xw5h-cmh3-8j6j'

CVE-2026-49875 is an information disclosure vulnerability in Apache CXF caused by improper XML parser configuration that allows out-of-band external entity resolution. This flaw affects the EndpointReferenceUtils and W3CMultiSchemaFactory classes, enabling remote attackers to disclose sensitive information without user interaction. The vulnerability is addressed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Red Hat products bundling Apache CXF are also affected, but currently no effective mitigation or fix meeting Red Hat's criteria is available for those products.