Search for packages
| purl | pkg:maven/org.apache.cxf/cxf-core@3.0.0-milestone2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-36wv-v2qp-v4g4
Aliases: CVE-2025-48795 |
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged Apache CXF stores large … |
Vulnerable |
|
GHSA-fh5r-crhr-qrrq
Aliases: CVE-2025-23184 |
Apache CXF: Denial of Service vulnerability with temporary files A potential denial of service vulnerability is present in versions of … |
Vulnerable |
|
GHSA-x3x3-qwjq-8gj4
Aliases: CVE-2022-46364 |
Apache CXF Server-Side Request Forgery vulnerability A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in … |
Vulnerable |
|
GHSA-3w37-5p3p-jv92
Aliases: CVE-2022-46363 |
Apache CXF vulnerable to Exposure of Sensitive Information A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an … |
Vulnerable |
|
CVE-2019-12406
|
Uncontrolled Resource Consumption Apache CXF does not restrict the number of message attachments present in a given message. This leaves … |
Vulnerable Vulnerable |
|
CVE-2020-1954
|
Information Exposure Apache CXF has the ability to integrate with JMX by registering an `InstrumentationManager` extension with the CXF bus. … |
Vulnerable Vulnerable |
|
CVE-2019-12423
|
Insufficiently Protected Credentials Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the … |
Vulnerable Vulnerable |
|
CVE-2024-28752
Aliases: GHSA-qmgx-j96g-4428 |
SSRF vulnerability using the Aegis DataBinding in Apache CXF A SSRF vulnerability using the Aegis DataBinding in versions of Apache … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-13954
|
Cross-site Scripting By default, Apache CXF creates a `/services` page containing a listing of the available endpoint names and addresses. … |
Vulnerable Vulnerable |
|
CVE-2021-22696
|
Uncontrolled Resource Consumption CXF supports (via `JwtRequestCodeFilter`) passing OAuth 2 parameters via a JWT token as opposed to query parameters … |
Vulnerable Vulnerable |
|
CVE-2018-8039
|
Improper Handling of Exceptional Conditions It is possible to configure Apache CXF to use the `com.sun.net.ssl` implementation via `System.setProperty`. When … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-12624
Aliases: GHSA-7vgj-8mw4-hg8r |
Improper Input Validation in Apache CXF Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-ghvc-7hp8-2g2v
Aliases: CVE-2026-50645 |
Apache cxf-core: No restriction on attachment headers per message There is no restriction on the amount of attachment headers that … |
Not vulnerable |
|
GHSA-hgg6-8x62-m9gf
Aliases: CVE-2017-5653 |
Improper Certificate Validation in Apache CXF JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-v936-x3j5-c76j
Aliases: CVE-2017-5656 |
Session Fixation in Apache CXF Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-7vgj-8mw4-hg8r
Aliases: CVE-2017-12624 |
Improper Input Validation in Apache CXF Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-vw2c-5wph-v92r
Aliases: CVE-2016-6812 |
Improper Neutralization of Input During Web Page Generation in Apache CXF The HTTP transport module in Apache CXF prior to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-x7xf-253v-x3w8
Aliases: CVE-2016-8739 |
Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS The JAX-RS module in Apache CXF prior to 3.0.12 … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-xw5h-cmh3-8j6j
Aliases: CVE-2026-49875 |
Apache CXF has Improper Restriction of XML External Entity Reference Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without … |
Not vulnerable Not vulnerable |