CVE-2026-44618

Published: May 22, 2026Modified: Jul 23, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected (3)

Products: Apache: Cxf

Apache

1 product

Cxf

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 3.6.11
Apache Cxf	From 4.0.0 to 4.1.6
Apache Cxf	Version 4.2.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/22/8

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.