PatchTheCEVcxf vulnerabilities and fixes
Recent CVEs affecting cxf, with upgrade or downgrade steps. 12 tracked.
cxf has 12 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-08-06. Highest priority: CVE-2026-66909 (score 64/100).
- CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
- CVE-2026-68079 CRITICAL 9.8 UPGRADE In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited
- CVE-2026-61466 CRITICAL 9.1 UPGRADE In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `
- CVE-2026-57817 HIGH 8.1 UPGRADE The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when opera
- CVE-2026-54225 HIGH 7.5 UPGRADE Apache CXF allows to control the maximum attachment size via the "attachment-max-size"
- CVE-2026-57819 HIGH 7.5 UPGRADE Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParamete
- CVE-2026-64958 HIGH 7.5 UPGRADE An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on
- CVE-2026-65432 HIGH 7.5 UPGRADE Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external en
- CVE-2026-68481 HIGH 7.5 UPGRADE In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and Toke
- CVE-2026-57818 HIGH 8.1 UPGRADE A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple t
- CVE-2026-63687 CRITICAL 9.1 UPGRADE Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter
- CVE-2026-65583 CRITICAL 9.1 UPGRADE Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required
FAQ
How do I fix cxf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cxf being exploited right now?
None of the tracked cxf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cxf CVE should I patch first?
CVE-2026-66909 currently ranks highest (64/100): Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ.