Apache Cxf vulnerabilities
80 published vulnerabilities in Apache Cxf. The most were published in 2026 (37), and 37 so far in 2026.
Apache Cxf vulnerabilities by year
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2024
2025
2026
Most exploited Apache Cxf vulnerabilities
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
- CVE-2022-46364 Apache CXF SSRF Vulnerability
- CVE-2019-12419 Potential session hijack in Apache CXF
- CVE-2012-0803 Improper Authentication in Apache CXF
- CVE-2010-2076 Improper Input Validation in Apache CXF
- CVE-2024-28752 Apache CXF SSRF Vulnerability using the Aegis databinding
- CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
- CVE-2026-71575 Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.