What is the CVSS score of EUVD-2026-36398?

EUVD-2026-36398 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache CXF are affected by EUVD-2026-36398?

Apache CXF's OAuth2 security module contains a critical HTTP Response Splitting vulnerability (no public exploit identified at time of analysis) that could allow unauthorized attackers to manipulate…. A patch is available.

How to fix or mitigate EUVD-2026-36398?

24 hours: Inventory all production and non-production systems running Apache CXF cxf-rt-rs-security-oauth2 versions 4.2.0-4.2.1 or any version prior to 4.1.7; document version numbers, deployment type, and business criticality. 7 days: Apply compensating controls immediately; schedule upgrade timeline to version 4.2.2 or later (4.2.x branch) or 4.1.7 or later (4.1.x branch); notify stakeholders of upgrade windows. 30 days: Complete upgrade to patched versions for all affected systems; validate OAuth2 functionality; audit logs for exploitation attempts; conduct post-upgrade security assessment.

Apache CXF EUVD-2026-36398

| CVE-2026-50630 MEDIUM

HTTP Response Splitting (CWE-113)

2026-06-11

GHSA-xf62-wr5p-5p95

Code Injection Cxf

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

Network vector, high complexity (realm control required), scope change to client, low C/I via header injection; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 12, 2026 - 15:22 NVD

CRITICAL MEDIUM

CVSS changed

Jun 12, 2026 - 15:22 NVD

6.5 (CRITICAL) 6.5 (MEDIUM)

Patch available

Jun 12, 2026 - 11:01 EUVD

Analysis Generated

Jun 11, 2026 - 18:21 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

HTTP Response Splitting via CRLF injection in Apache CXF's OAuth2 module allows an attacker who controls the WWW-Authenticate realm parameter to inject arbitrary HTTP headers or split HTTP responses entirely. Affected deployments include cxf-rt-rs-security-oauth2 versions 4.2.0 before 4.2.2 and all versions before 4.1.7. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but successful exploitation could enable cache poisoning, header injection, or redirection of downstream HTTP clients processing the malformed response.

Technical ContextAI

Apache CXF is an open-source Java services framework supporting JAX-WS and JAX-RS, widely used for building SOAP and RESTful services. The vulnerable component is the Maven artifact org.apache.cxf:cxf-rt-rs-security-oauth2, which implements OAuth2 authorization flows. The flaw resides in the AuthorizationUtils class, which constructs WWW-Authenticate response headers for OAuth2 challenges. The 'realm' parameter - used to identify the protection space per RFC 7235 - is concatenated directly into the header value without stripping or encoding carriage return (CR, \r) and line feed (LF, \n) characters. This is a classic HTTP Response Splitting vulnerability (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers), where injected CRLF sequences prematurely terminate one header field and begin another, or split the response into two distinct HTTP messages. An attacker who can influence the realm value passed to AuthorizationUtils can exploit this to inject headers such as Set-Cookie, Location, or arbitrary body content into the HTTP response stream.

RemediationAI

Upgrade to Apache CXF 4.2.2 or 4.1.7, both released on June 10, 2026, per the official Apache CXF project page at https://cxf.apache.org/. These releases include targeted sanitization of CRLF characters in the OAuth2 realm parameter within AuthorizationUtils. If immediate upgrade is not feasible, a compensating control is to ensure the realm value passed to the OAuth2 WWW-Authenticate header is sourced exclusively from static, administrator-controlled server configuration rather than any user-supplied or request-derived input; this eliminates the attacker's ability to inject CRLF sequences but does not fix the underlying code defect. Additionally, deploying a reverse proxy or WAF rule to strip or block requests containing percent-encoded or literal CRLF sequences (%0d, %0a, \r, \n) in OAuth2-related request parameters can reduce exposure, though this may interfere with legitimate encoded values. The 3.6.x branch was not explicitly addressed in the June 10 release notes - organizations on that branch should consult the Security Advisories page at https://cxf.apache.org/ to determine applicability.