Apache Cxf

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.

Apache CXF SSRF Vulnerability

Apache CXF: Untrusted JMS configuration can lead to RCE

Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

Apache CXF SSRF Vulnerability using the Aegis databinding

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF: Self-issued ID token claims validation skipped

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.

Bypass of the secureValidation property

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

OAuth 2 authorization service vulnerable to DDos attacks

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.

Apache CXF: Denial of Service vulnerability with temporary files

Apache CXF Denial of Service vulnerability in JOSE

Apache CXF directory listing / code exfiltration

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF: Denial of Service attack via large attachments

Apache CXF: No restriction on attachment headers per message

Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

Apache CXF: XXE via WSDL/XSD import parsing

Apache CXF: Denial of service via message header attachments