CVE Tools
Track your stack

Apache Cxf

58 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Apache Cxf, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Cxf CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Cxf CVEs per month
MonthCVEs
2024-120
2025-011
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-081
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-053
2026-0611
2026-070
2026-0812
2026-090
2026-1011
2026-110

Severity

How the 58 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1729%
  • High2848%
  • Medium1322%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Cxf.

  1. CVE-2026-108039Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits7.5
  2. CVE-2026-107938Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.9.1
  3. CVE-2026-107937Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.7.5
  4. CVE-2026-100227Apache CXF: XML Signature wrapping in JAX-RS XML Security7.5
  5. CVE-2026-97791Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests7.5
  6. CVE-2026-97468Apache CXF: Authentication bypass via weak cache keys for validated STS tokens9.1
  7. CVE-2026-86463Apache CXF: FIQL Query Parser Denial of Service7.5
  8. CVE-2026-79650Apache CXF: OIDC RP Open Redirect6.1
  9. CVE-2026-78384Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)7.5
  10. CVE-2026-73179Apache CXF: JPA authorization-code consume is non-atomic8.1
  11. CVE-2026-71575Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter9.1
  12. CVE-2026-57818Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider8.1
  13. CVE-2026-61466Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation9.1
  14. CVE-2026-63687Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters9.1
  15. CVE-2026-65583Apache CXF: Self-issued ID token claims validation skipped9.1

Product grouping is registry-driven, with AI assist and human review. How it works