CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
| CWE | CWE-611 |
| Vendor | apache software foundation |
| Product | apache cxf |
| Published | Jun 12, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache cxf
Be the first to know when new medium vulnerabilities affecting apache software foundation apache cxf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache CXF
4.2.0 < 4.2.2 0 < 4.1.7
References
lists.apache.org: https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o openwall.com: http://www.openwall.com/lists/oss-security/2026/06/11/2 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-49875 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2488309 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36839 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37390
Credits
Venkatraman Kumar (r3dw0lfsec), Securin