Apache cxf

This hub aggregates every CVE we track for Apache cxf, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache cxf.

• CVE-2026-57818Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider8.1Aug 6, 2026
• CVE-2026-61466Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation9.1Aug 6, 2026
• CVE-2026-63687Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters9.1Aug 6, 2026
• CVE-2026-65583Apache CXF: Self-issued ID token claims validation skipped9.1Aug 6, 2026
• CVE-2026-68079Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay9.8Aug 6, 2026
• CVE-2026-68481Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider7.5Aug 6, 2026
• CVE-2026-65432Apache CXF: XXE via WSDL/XSD import parsing7.5Aug 6, 2026
• CVE-2026-57817Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow8.1Aug 6, 2026
• CVE-2026-66909Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage9.8Aug 6, 2026
• CVE-2026-64958Apache CXF: Denial of service via message header attachments7.5Aug 6, 2026
• CVE-2026-57819Apache CXF: No default restriction on the amount of form parameters per message7.5Aug 6, 2026
• CVE-2026-54225Apache CXF: Denial of Service attack via large attachments7.5Aug 6, 2026
• CVE-2026-50645Apache CXF: No restriction on attachment headers per message7.5Jun 12, 2026
• CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry6.5Jun 12, 2026
• CVE-2026-50633Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl8.1Jun 12, 2026