Search for packages
| purl | pkg:maven/org.apache.cxf/cxf-core@3.3.6 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-36wv-v2qp-v4g4
Aliases: CVE-2025-48795 |
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged Apache CXF stores large … |
Vulnerable |
|
GHSA-fh5r-crhr-qrrq
Aliases: CVE-2025-23184 |
Apache CXF: Denial of Service vulnerability with temporary files A potential denial of service vulnerability is present in versions of … |
Vulnerable |
|
GHSA-x3x3-qwjq-8gj4
Aliases: CVE-2022-46364 |
Apache CXF Server-Side Request Forgery vulnerability A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in … |
Vulnerable |
|
GHSA-3w37-5p3p-jv92
Aliases: CVE-2022-46363 |
Apache CXF vulnerable to Exposure of Sensitive Information A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an … |
Vulnerable |
|
CVE-2024-28752
Aliases: GHSA-qmgx-j96g-4428 |
SSRF vulnerability using the Aegis DataBinding in Apache CXF A SSRF vulnerability using the Aegis DataBinding in versions of Apache … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-13954
|
Cross-site Scripting By default, Apache CXF creates a `/services` page containing a listing of the available endpoint names and addresses. … |
Vulnerable Vulnerable |
|
CVE-2021-22696
|
Uncontrolled Resource Consumption CXF supports (via `JwtRequestCodeFilter`) passing OAuth 2 parameters via a JWT token as opposed to query parameters … |
Vulnerable Vulnerable |
|
GHSA-ghvc-7hp8-2g2v
Aliases: CVE-2026-50645 |
Apache cxf-core: No restriction on attachment headers per message There is no restriction on the amount of attachment headers that … |
Not vulnerable |
|
GHSA-xw5h-cmh3-8j6j
Aliases: CVE-2026-49875 |
Apache CXF has Improper Restriction of XML External Entity Reference Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without … |
Not vulnerable Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2019-12406
|
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This … | |
|
CVE-2017-12624
|
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a … | |
|
CVE-2020-1954
|
Information Exposure Apache CXF has the ability to integrate with JMX by registering an `InstrumentationManager` extension with the CXF bus. … |