CVE-2026-50630

Published: Jun 12, 2026Modified: Jun 12, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Affected (2)

Products: Apache: Cxf

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 4.1.7
Apache Cxf	From 4.2.0 to 4.2.2

Related CWEs

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

References (2)

https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/06/11/7

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.