CVE-2021-22696 OAuth 2 authorization service vulnerable to DDos attacks

What is CVE-2021-22696?

CVE-2021-22696 is a high-severity server-side request forgery vulnerability in Apache Cxf, published on 2 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.

Weakness: CWE-918, CWE-400

Which versions are affected by CVE-2021-22696?

8 open source packages ship an affected version, including org.apache.cxf:apache-cxf and org.apache.cxf:cxf. It affects 6 products.

Products include Apache Cxf, Oracle Business Intelligence, Oracle Communications Diameter Intelligence Hub, Oracle Communications Element Manager, Oracle Communications Session Report Manager, Oracle Communications Session Route Manager.

How do I fix CVE-2021-22696?

Upgrade org.apache.cxf:apache-cxf to a fixed version for your release line: 3.3.10 or 3.4.3.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-22696 being exploited?

There is no known exploitation of CVE-2021-22696 in the wild and no public exploit code.

Other vulnerabilities in Apache Cxf

• CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF Critical 10.0
• CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage Critical 9.8
• CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay Critical 9.8
• CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control Critical 9.8
• CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE Critical 9.8

All Apache Cxf vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7q4h-pj78-j7vg.