[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGAm2KKAgc7YTZbXTZruV+yyrLsS0YCx33A7kp5SozwCHg@mail.gmail.com>
Date: Fri, 22 May 2026 12:11:27 +0100
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality
Severity: important
Affected versions:
- Apache CXF (org.apache.cxf:cxf-rt-ws-transfer) 4.2.0 before 4.2.1
- Apache CXF (org.apache.cxf:cxf-rt-ws-transfer) 4.0.0 before 4.1.6
- Apache CXF (org.apache.cxf:cxf-rt-ws-transfer) before 3.6.11
Description:
Insecure XML parser configuration in Apache CXF's WS-Transfer module
may allow attackers to perform XXE attacks.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11,
which fix this issue.
Credit:
Credit to IcySun (icysun@...com), 广东东方思维科技有限公司 (finder)
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-44618
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
