CVE-2026-44618
Fixed upstream EPSS <1%CVSS 5.3
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Products: Apache Software Foundation Apache CXF
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.cxf:cxf-rt-ws-transfer | 4.2.1 |
| Maven | org.apache.cxf:cxf-rt-ws-transfer | 4.1.6 |
| Maven | org.apache.cxf:cxf-rt-ws-transfer | 3.6.11 |