by Kastro
Paper/Archive/CVE-2026-44930

CVE-2026-44930

Apache Software Foundation Apache CXF — Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.9.539 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.  Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected

ProductAffectedFixed inSource
Apache CXF4.2.0 – < 4.2.14.2.1CNA
Apache CXF4.0.0 – < 4.1.64.1.6CNA
Apache CXF< 3.6.113.6.11CNA
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisoryrepo-ldapredhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADP4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorylists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkhrefopenwall.com/lists/oss-security/2026/05/22/9refaccess.redhat.com/security/cve/CVE-2026-44930refbugzilla.redhat.com/show_bug.cgi?id=2480728refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44930.jsonadvisoryaccess.redhat.com/errata/RHSA-2026:37390