GHSA-vmm5-fjgx-2jhpMediumCVSS 5.3

Apache CXF's WS-Transfer module has an insecure XML parser configuration

Published
May 26, 2026
Last Modified
June 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-44618 →

📋 Description

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

🎯 Affected products3

  • maven/org.apache.cxf:cxf-rt-ws-transfer:= 4.2.0
  • maven/org.apache.cxf:cxf-rt-ws-transfer:>= 4.1.0, < 4.1.6
  • maven/org.apache.cxf:cxf-rt-ws-transfer:< 3.6.11

🔗 References (4)