SB20260824145 - Multiple vulnerabilities in Apache CXF

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824145

SB20260824145 - Multiple vulnerabilities in Apache CXF

Published: August 24, 2026

Security Bulletin ID SB20260824145
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 67% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54225)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource control in attachment processing when handling large attachments without a configured maximum attachment size. A remote attacker can send a specially crafted request with a large attachment to cause a denial of service.

Only deployments that do not explicitly configure an attachment size limit are vulnerable.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-57819)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource allocation in the JAX-RS form parameter processing in cxf-rt-frontend-jaxrs when handling requests with very large numbers of form parameters. A remote attacker can send a specially crafted request to cause a denial of service.


3) Input validation error (CVE-ID: CVE-2026-64958)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in message header attachment processing when handling messages with many attachment headers. A remote attacker can send a specially crafted message to cause a denial of service.


4) XML External Entity injection (CVE-ID: CVE-2026-65432)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper restriction of XML external entity references in WSDL4J import parsing when processing imported WSDL or XSD documents referenced by a top-level WSDL. A remote attacker can supply a specially crafted imported WSDL or XSD document to disclose sensitive information.

The issue affects imported documents referenced through <wsdl:import> or <xsd:import>, while the top-level WSDL is processed through a hardened parsing path.


5) Deserialization of Untrusted Data (CVE-ID: CVE-2026-66909)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to unsafe deserialization in the JMS transport when processing an inbound JMS ObjectMessage. A remote attacker can place a malicious serialized object on the service's JMS destination to execute arbitrary code or cause a denial of service.

Remote code execution is possible if a suitable gadget class is present on the classpath.


6) Improper Authentication (CVE-ID: CVE-2026-57817)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject or substitute an authorization code.

The vulnerability exists due to improper authentication in the OIDC relying party hybrid flow implementation when processing hybrid flow responses from a non-compliant or misconfigured identity provider that omits the c_hash parameter. A remote attacker can supply a substituted authorization code to inject or substitute an authorization code.

Exploitation requires integration with an identity provider that omits the c_hash parameter in the hybrid OIDC flow.


7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-57818)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain multiple valid access tokens from a single authorization code.

The vulnerability exists due to a race condition in JCacheCodeDataProvider when processing concurrent authorization code redemption requests. A remote attacker can send concurrent requests to obtain multiple valid access tokens from a single authorization code.


8) Improper Authorization (CVE-ID: CVE-2026-61466)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to self-assign privileged scopes.

The vulnerability exists due to improper access control in the OAuth2 Dynamic Client Registration endpoint when processing client registration requests. A remote user can submit a registration request with a crafted scope value to self-assign privileged scopes.


9) Input validation error (CVE-ID: CVE-2026-63687)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to undermine PKCE integrity and OpenID Connect replay protection.

The vulnerability exists due to improper input validation in JwtRequestCodeFilter when copying claims from a signed request JWT into the authorization parameter map. A remote user can provide a validly signed request JWT to override outer code_challenge, code_challenge_method, nonce, and state values to undermine PKCE integrity and OpenID Connect replay protection.

Exploitation requires the ability to produce a validly signed request JWT, such as when a client secret is known or compromised.


10) Improper Authentication (CVE-ID: CVE-2026-65583)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper access control in the OIDC relying-party token validator when processing self-issued ID tokens. A remote attacker can supply a crafted token to bypass authentication.

Self-issued ID tokens are not accepted by default in the validator.


11) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68079)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redeem an authorization code multiple times.

The vulnerability exists due to improper authorization code invalidation in DefaultEncryptingCodeDataProvider when processing authorization code redemption. A remote attacker can reuse a captured authorization code to redeem an authorization code multiple times.

This issue violates the OAuth requirement that an authorization code must not be used more than once.


12) Improper access control (CVE-ID: CVE-2026-68481)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to continue using revoked OAuth tokens.

The vulnerability exists due to improper access control in DefaultEncryptingOAuthDataProvider and TokenIntrospectionService when processing revoked access or refresh tokens. A remote user can present a revoked token to continue using revoked OAuth tokens.

The issue affects both access tokens and refresh tokens, and token introspection may incorrectly report a revoked token as active.


Remediation

Install update from vendor's website.

References