EUVD-2026-53856
GHSA-jvhw-7q2c-2r65
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H because attacker must control a resource in the WSDL import chain; C:H for arbitrary local file disclosure via XXE; A:L for potential entity-expansion DoS; no integrity impact from read-only XXE.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
AnalysisAI
XML External Entity injection in Apache CXF's WSDL import processing allows attackers who can influence imported WSDL or XSD documents to bypass XXE protections applied to the top-level WSDL. CXF correctly hardens top-level WSDL parsing via StaxUtils, but delegates all <wsdl:import> and <xsd:import> resolution to WSDL4J, which lacks equivalent DOCTYPE and external entity restrictions - creating a security boundary mismatch that nullifies the top-level protections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Apache CXF service to process a WSDL document containing at least one <wsdl:import> or <xsd:import> element whose referenced resource is under attacker influence or control. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No vendor or NVD CVSS score is available for this CVE, requiring all metric estimates to be independently assessed from the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to a patched Apache CXF release: 4.2.3 for 4.2.x deployments, 4.1.8 for 4.1.x deployments, or 3.6.12 for 3.6.x deployments, as specified in the Apache advisory at https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache CXF deployments across production, staging, and development environments to identify affected versions and release branches; concurrently, review and document any external or user-supplied WSDL/XSD sources to assess exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Cxf
View allArbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
Unsafe deserialization in Apache CXF's JMS transport allows any party able to publish to the service's JMS destination t
Remote code execution in Apache CXF (versions before 3.6.11, 4.0.0-4.1.5, and 4.2.0) arises because the fix for CVE-2025
Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated ne
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and int
Double-spending of OAuth2 authorization codes in Apache CXF's JCacheCodeDataProvider enables issuance of multiple valid
Apache CXF's JwtRequestCodeFilter blindly copies all claims from a validly-signed JWT request object into the OAuth2 aut
Authentication bypass in Apache CXF's OIDC relying-party implementation allows network-accessible attackers to forge sel
Apache CXF's DefaultEncryptingCodeDataProvider allows captured OAuth 2.0 authorization codes to be redeemed an unlimited
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh token
Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to h
Share
External POC / Exploit Code
Leaving vuln.today