by Kastro CVE-2026-49875
Apache Software Foundation Apache CXF — Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
Description · from the CVE record
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
Affected
ProductAffectedFixed inSource
Apache CXF4.2.0 – < 4.2.24.2.2CNA
Apache CXF4.0.0 – < 4.1.74.1.7CNA
Apache CXF< 3.6.123.6.12CNA
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisory–redhat-SADP
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33see advisory–redhat-SADP
Red Hat build of Apache Camel 4 for Quarkus 3see advisory–redhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 8see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP
Red Hat JBoss Web Server 5see advisory–redhat-SADP
Red Hat Single Sign-On 7see advisory–redhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADP6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial