CRITICAL9.8
GHSA-xw5h-cmh3-8j6j
Apache CXF has Improper Restriction of XML External Entity Reference
Quick fix
GHSA-xw5h-cmh3-8j6j — org.apache.cxf:cxf-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-coreDetails
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.apache.cxf:cxf-core
Introduced in:
4.2.0Fixed in: 4.2.2Fix
# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-coreMaven/org.apache.cxf:cxf-core
Introduced in:
0Fixed in: 4.1.7Fix
# pom.xml: bump <version>4.1.7</version> for org.apache.cxf:cxf-coreReferences
- https://nvd.nist.gov/vuln/detail/CVE-2026-49875[ADVISORY]
- https://access.redhat.com/errata/RHSA-2026:36839[WEB]
- https://access.redhat.com/errata/RHSA-2026:37390[WEB]
- https://access.redhat.com/security/cve/CVE-2026-49875[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2488309[WEB]
- https://cxf.apache.org/security-advisories.data/CVE-2026-49875.txt[WEB]
- https://github.com/apache/cxf[PACKAGE]
- https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o[WEB]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json[WEB]
- http://www.openwall.com/lists/oss-security/2026/06/11/2[WEB]