[<prev] [next>] [day] [month] [year] [list]
Message-ID: <c91c9777-7841-6156-b046-f737a8e0c730@apache.org>
Date: Thu, 11 Jun 2026 16:56:27 +0000
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via
WWW-Authenticate Realm Injection
Severity: low
Affected versions:
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) 4.2.0 before 4.2.2
- Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2) before 4.1.7
Description:
A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Credit:
Guanping Zhang reported this vulnerability. (finder)
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-50630
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
