# Apache Cxf


- [CVE-2012-2379](https://insights.sbomify.com/CVE-2012-2379/): XML Signature/Encryption Not Validated in Apache CXF (critical 10.0)
- [CVE-2026-66909](https://insights.sbomify.com/CVE-2026-66909/): Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage (critical 9.8)
- [CVE-2026-68079](https://insights.sbomify.com/CVE-2026-68079/): Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay (critical 9.8)
- [CVE-2026-50628](https://insights.sbomify.com/CVE-2026-50628/): Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control (critical 9.8)
- [CVE-2025-48913](https://insights.sbomify.com/CVE-2025-48913/): Apache CXF: Untrusted JMS configuration can lead to RCE (critical 9.8)
- [CVE-2022-46364](https://insights.sbomify.com/CVE-2022-46364/): Apache CXF SSRF Vulnerability (critical 9.8)
- [CVE-2019-12419](https://insights.sbomify.com/CVE-2019-12419/): Potential session hijack in Apache CXF (critical 9.8)
- [CVE-2012-0803](https://insights.sbomify.com/CVE-2012-0803/): Improper Authentication in Apache CXF (critical 9.8)
- [CVE-2010-2076](https://insights.sbomify.com/CVE-2010-2076/): Improper Input Validation in Apache CXF (critical 9.8)
- [CVE-2024-28752](https://insights.sbomify.com/CVE-2024-28752/): Apache CXF SSRF Vulnerability using the Aegis databinding (critical 9.3)
- [CVE-2026-107938](https://insights.sbomify.com/CVE-2026-107938/): Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. (critical 9.1)
- [CVE-2026-71575](https://insights.sbomify.com/CVE-2026-71575/): Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/cxf/