Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.cxf/cxf-core@3.6.6
purl pkg:maven/org.apache.cxf/cxf-core@3.6.6
Next non-vulnerable version 3.6.12
Latest non-vulnerable version 4.2.2
Risk score 4.4
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-ghvc-7hp8-2g2v
Aliases:
CVE-2026-50645
Apache cxf-core: No restriction on attachment headers per message There is no restriction on the amount of attachment headers that …
3.6.12
Not vulnerable
GHSA-xw5h-cmh3-8j6j
Aliases:
CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without …
4.1.7
Not vulnerable
3.6.12
Not vulnerable
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
GHSA-36wv-v2qp-v4g4
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged Apache CXF stores large … CVE-2025-48795