EUVD-2026-36398
GHSA-xf62-wr5p-5p95
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network vector, high complexity (realm control required), scope change to client, low C/I via header injection; no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
HTTP Response Splitting via CRLF injection in Apache CXF's OAuth2 module allows an attacker who controls the WWW-Authenticate realm parameter to inject arbitrary HTTP headers or split HTTP responses entirely. Affected deployments include cxf-rt-rs-security-oauth2 versions 4.2.0 before 4.2.2 and all versions before 4.1.7. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but successful exploitation could enable cache poisoning, header injection, or redirection of downstream HTTP clients processing the malformed response.
Technical ContextAI
Apache CXF is an open-source Java services framework supporting JAX-WS and JAX-RS, widely used for building SOAP and RESTful services. The vulnerable component is the Maven artifact org.apache.cxf:cxf-rt-rs-security-oauth2, which implements OAuth2 authorization flows. The flaw resides in the AuthorizationUtils class, which constructs WWW-Authenticate response headers for OAuth2 challenges. The 'realm' parameter - used to identify the protection space per RFC 7235 - is concatenated directly into the header value without stripping or encoding carriage return (CR, \r) and line feed (LF, \n) characters. This is a classic HTTP Response Splitting vulnerability (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers), where injected CRLF sequences prematurely terminate one header field and begin another, or split the response into two distinct HTTP messages. An attacker who can influence the realm value passed to AuthorizationUtils can exploit this to inject headers such as Set-Cookie, Location, or arbitrary body content into the HTTP response stream.
RemediationAI
Upgrade to Apache CXF 4.2.2 or 4.1.7, both released on June 10, 2026, per the official Apache CXF project page at https://cxf.apache.org/. These releases include targeted sanitization of CRLF characters in the OAuth2 realm parameter within AuthorizationUtils. If immediate upgrade is not feasible, a compensating control is to ensure the realm value passed to the OAuth2 WWW-Authenticate header is sourced exclusively from static, administrator-controlled server configuration rather than any user-supplied or request-derived input; this eliminates the attacker's ability to inject CRLF sequences but does not fix the underlying code defect. Additionally, deploying a reverse proxy or WAF rule to strip or block requests containing percent-encoded or literal CRLF sequences (%0d, %0a, \r, \n) in OAuth2-related request parameters can reduce exposure, though this may interfere with legitimate encoded values. The 3.6.x branch was not explicitly addressed in the June 10 release notes - organizations on that branch should consult the Security Advisories page at https://cxf.apache.org/ to determine applicability.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Same weakness CWE-113 – HTTP Response Splitting
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today