CVE catalog

CVE-2026-44618

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this iss

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

A flaw was found in Apache CXF. An insecure XML parser configuration within Apache CXF's WS-Transfer module may allow a remote attacker to perform XML External Entity (XXE) attacks. This could lead to information disclosure, denial of service, or server-side request forgery. org.apache.cxf/cxf-rt-ws-transfer: Apache CXF: XML External Entity (XXE) attack via insecure XML parser configuration Red Hat products that ship Apache CXF either do not include the WS-Transfer module (cxf-rt-ws-transfer) or ship version 4.1.7, which already contains the fix for this vulnerability. No Red Hat product is affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpecxfNot reported3.6.11fixed
CpecxfNot reported4.1.6fixed
CpecxfNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpecxfcpeNot reported3.6.11Not reportedNot reportedNot reported
CpecxfcpeNot reported4.1.6Not reportedNot reportedNot reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]