CVE-2026-50630

UNKNOWN 0.0

Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

CWE	CWE-113
Vendor	apache software foundation
Product	apache cxf
Published	Jun 12, 2026
Last Updated	Jun 12, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache cxf

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache cxf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache CXF

4.2.0 < 4.2.2 0 < 4.1.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm openwall.com: http://www.openwall.com/lists/oss-security/2026/06/11/7

Credits

Guanping Zhang reported this vulnerability.