Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.cxf/cxf-core@4.0.4
purl pkg:maven/org.apache.cxf/cxf-core@4.0.4
Next non-vulnerable version 4.1.7
Latest non-vulnerable version 4.2.2
Risk score 4.4
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
GHSA-36wv-v2qp-v4g4
Aliases:
CVE-2025-48795
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged Apache CXF stores large …
4.0.7
Vulnerable
GHSA-fh5r-crhr-qrrq
Aliases:
CVE-2025-23184
Apache CXF: Denial of Service vulnerability with temporary files A potential denial of service vulnerability is present in versions of …
4.0.6
Vulnerable
GHSA-ghvc-7hp8-2g2v
Aliases:
CVE-2026-50645
Apache cxf-core: No restriction on attachment headers per message There is no restriction on the amount of attachment headers that …
4.1.7
Not vulnerable
GHSA-xw5h-cmh3-8j6j
Aliases:
CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without …
4.1.7
Not vulnerable
4.1.7
Not vulnerable
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
CVE-2024-28752
SSRF vulnerability using the Aegis DataBinding in Apache CXF A SSRF vulnerability using the Aegis DataBinding in versions of Apache … GHSA-qmgx-j96g-4428