Live › vulnerability › CVE-2026-49875
Go to dashboardApache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory build an XML parser without the standard hardening, so attacker-supplied XML can make the server fetch external entities. An attacker can use this to read data from the server and reach internal resources through out-of-band exfiltration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:19 UTC, 0h before NVD. All times on this page are UTC.
Applications that use Apache CXF cxf-core and parse XML from untrusted sources, such as SOAP or web service endpoints that accept XML from clients, are exposed. The sources do not say which CXF features reach the vulnerable classes in default configuration, so unknown whether all deployments are reached. Projects that do not depend on cxf-core can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.cxf:cxf-core | maven | >= 4.2.0, < 4.2.2 | 4.2.2 |
| org.apache.cxf:cxf-core | maven | >= 4.0.0, < 4.1.7 | 4.1.7 |
| org.apache.cxf:cxf-core | maven | < 3.6.12 | 3.6.12 |
| apache cxf | vendor | < 4.1.7 | 4.1.7 |
| apache cxf | vendor | >= 4.2.0, < 4.2.2 | 4.2.2 |
mvn dependency:tree | grep cxf-core4.2.0 to 4.2.2 (exclusive), 4.0.0 to 4.1.7 (exclusive), or below 3.6.12org.apache.cxf:cxf-core to 4.2.2 on the 4.2 line, to 4.1.7 on the 4.1 line, or to 3.6.12 on the 3.6 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-49875")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.