All vulnerabilities
CVE-2026-49875GHSA-xw5h-cmh3-8j6j

org.apache.cxf:cxf-core: Apache CXF has Improper Restriction of XML External Entity Reference

Apache Software Foundation org.apache.cxf:cxf-coremavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.81%Chance of exploitation activity in the next 30 days, higher than 56% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.2Also 4.1.7, 3.6.12GitHub
Published12 Jun 2026Updated 2 Oct 2026CVE List

What fixes it

  • 4.2.2org.apache.cxf:cxf-core, mavenGitHub<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-core</artifactId><version>4.2.2</version></dependency>
  • 4.1.7org.apache.cxf:cxf-core, mavenGitHub<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-core</artifactId><version>4.1.7</version></dependency>
  • 4.2.2Apache CXFCVE List
  • 4.1.7Apache CXFCVE List
  • 3.6.12Apache CXFCVE List
  • 4.2.2org.apache.cxf:cxf-core, MavenOSV<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-core</artifactId><version>4.2.2</version></dependency>
Show all 7 fixed versions
  • 4.1.7org.apache.cxf:cxf-core, MavenOSV<dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-core</artifactId><version>4.1.7</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Text from GitHub Advisory Database

Affected versions 59

  • org.apache.cxf:cxf-core, maven>= 4.2.0, < 4.2.2GitHub
  • org.apache.cxf:cxf-core, maven< 4.1.7GitHub
  • Apache CXFaffected: 4.2.0 before 4.2.2CVE List
  • Apache CXFaffected: 4.0.0 before 4.1.7CVE List
  • Apache CXFaffected: all versions before 3.6.12CVE List
  • org.apache.cxf:cxf-core, Mavenfrom 4.2.0, fixed in 4.2.2OSV
  • org.apache.cxf:cxf-core, Maven4.2.0OSV
  • org.apache.cxf:cxf-core, Maven4.2.1OSV
  • org.apache.cxf:cxf-core, Mavenfrom first release, fixed in 4.1.7OSV
  • org.apache.cxf:cxf-core, Maven3.0.0OSV
  • org.apache.cxf:cxf-core, Maven3.0.0-milestone1OSV
  • org.apache.cxf:cxf-core, Maven3.0.0-milestone2OSV
  • org.apache.cxf:cxf-core, Maven3.0.1OSV
  • org.apache.cxf:cxf-core, Maven3.0.10OSV
  • org.apache.cxf:cxf-core, Maven3.0.11OSV
  • org.apache.cxf:cxf-core, Maven3.0.12OSV
  • org.apache.cxf:cxf-core, Maven3.0.13OSV
  • org.apache.cxf:cxf-core, Maven3.0.14OSV
  • org.apache.cxf:cxf-core, Maven3.0.15OSV
  • org.apache.cxf:cxf-core, Maven3.0.16OSV
  • org.apache.cxf:cxf-core, Maven3.0.2OSV
  • org.apache.cxf:cxf-core, Maven3.0.3OSV
  • org.apache.cxf:cxf-core, Maven3.0.4OSV
  • org.apache.cxf:cxf-core, Maven3.0.5OSV
  • org.apache.cxf:cxf-core, Maven3.0.6OSV
  • org.apache.cxf:cxf-core, Maven3.0.7OSV
  • org.apache.cxf:cxf-core, Maven3.0.8OSV
  • org.apache.cxf:cxf-core, Maven3.0.9OSV
  • org.apache.cxf:cxf-core, Maven3.1.0OSV
  • org.apache.cxf:cxf-core, Maven3.1.1OSV
  • org.apache.cxf:cxf-core, Maven3.1.10OSV
  • org.apache.cxf:cxf-core, Maven3.1.11OSV
  • org.apache.cxf:cxf-core, Maven3.1.12OSV
  • org.apache.cxf:cxf-core, Maven3.1.13OSV
  • org.apache.cxf:cxf-core, Maven3.1.14OSV
  • org.apache.cxf:cxf-core, Maven3.1.15OSV
  • org.apache.cxf:cxf-core, Maven3.1.16OSV
  • org.apache.cxf:cxf-core, Maven3.1.17OSV
  • org.apache.cxf:cxf-core, Maven3.1.18OSV
  • org.apache.cxf:cxf-core, Maven3.1.2OSV
  • org.apache.cxf:cxf-core, Maven3.1.3OSV
  • org.apache.cxf:cxf-core, Maven3.1.4OSV
  • org.apache.cxf:cxf-core, Maven3.1.5OSV
  • org.apache.cxf:cxf-core, Maven3.1.6OSV
  • org.apache.cxf:cxf-core, Maven3.1.7OSV
  • org.apache.cxf:cxf-core, Maven3.1.8OSV
  • org.apache.cxf:cxf-core, Maven3.1.9OSV
  • org.apache.cxf:cxf-core, Maven3.2.0OSV
  • org.apache.cxf:cxf-core, Maven3.2.1OSV
  • org.apache.cxf:cxf-core, Maven3.2.10OSV
  • org.apache.cxf:cxf-core, Maven3.2.11OSV
  • org.apache.cxf:cxf-core, Maven3.2.12OSV
  • org.apache.cxf:cxf-core, Maven3.2.13OSV
  • org.apache.cxf:cxf-core, Maven3.2.14OSV
  • org.apache.cxf:cxf-core, Maven3.2.2OSV
  • org.apache.cxf:cxf-core, Maven3.2.3OSV
  • org.apache.cxf:cxf-core, Maven3.2.4OSV
  • org.apache.cxf:cxf-core, Maven3.2.5OSV
  • org.apache.cxf:cxf-core, Maven3.2.6OSV

References 9