← CVE Intelligence

CVE-2026-44618

Apache CXF: XXE vulnerability in WS-Transfer functionality PUBLISHED

Description (CNA)

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache CXFaffected 4.2.0 before 4.2.1; affected 4.0.0 before 4.1.6; affected 0 before 3.6.11

CWE

CWE-611

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.