← Back to CVE Explorer

CVE-2026-49875

Full vulnerability record from the local CVENow database.

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Severity
CRITICAL
CVSS score
9.8 (v3.1)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-06-12 10:16:22.340000
Last modified
2026-10-29 14:43:06.560000
View original CVE JSON 
{
  "id": "CVE-2026-49875",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T10:16:22.340",
  "lastModified": "2026-10-29T14:43:06.560",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) \nexternal entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue."
    },
    {
      "lang": "es",
      "value": "Las clases EndpointReferenceUtils y W3CMultiSchemaFactory de Apache CXF construyen una SAXParserFactory sin las configuraciones de endurecimiento JAXP necesarias, lo que permite la resolución de entidades externas fuera de banda (OOB). Se recomienda a los usuarios actualizar a las versiones 4.2.2 o 4.1.7, que solucionan este problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache CXF",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.cxf:cxf-core",
          "versions": [
            {
              "version": "4.2.0",
              "lessThan": "4.2.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.0.0",
              "lessThan": "4.1.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.6.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:apache_camel_spring_boot:4.18"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:apache_camel_quarkus:3.33"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Web Server 5",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_web_server:5"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Single Sign-On 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cxf-core",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T19:21:17.668934Z",
          "id": "CVE-2026-49875",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.6.12",
              "matchCriteriaId": "09753EF1-BB56-4238-8ED7-609E2AB5EB05"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.1.7",
              "matchCriteriaId": "B1F06BBE-6F15-4567-A427-204A602A9714"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.2.0",
              "versionEndExcluding": "4.2.2",
              "matchCriteriaId": "B1BF06FC-96AD-4663-9959-1B1493D4A2A0"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.1",
              "versionEndExcluding": "8.1.8",
              "matchCriteriaId": "B819B958-E86D-48C8-868E-DAA30F0CA801"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:build_of_apache_camel:*:*:*:*:*:quarkus:*:*",
              "versionEndExcluding": "3.33.2",
              "matchCriteriaId": "AFBAF807-DBF6-4409-B2A5-DB5A8C3564C1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:build_of_apache_camel:*:*:*:*:*:spring_boot:*:*",
              "versionEndExcluding": "4.18.1",
              "matchCriteriaId": "90230BF5-F78D-41AA-B78D-9D88656044F3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:build_of_apache_camel:3.33.2:-:*:*:*:quarkus:*:*",
              "matchCriteriaId": "6586A9AA-5608-42BC-ADD5-B7623FB106C0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:build_of_apache_camel:3.33.2:update1:*:*:*:quarkus:*:*",
              "matchCriteriaId": "8FA478D8-3002-487A-9F92-598A8116CA3D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:build_of_apache_camel:4.18.1:-:*:*:*:spring_boot:*:*",
              "matchCriteriaId": "EE50F3F2-BE01-48E9-90D3-3710C64CC702"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAD91726-93D9-4230-BF69-6A79B58E09E0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "88BF3B2C-B121-483A-AEF2-8082F6DA5310"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:jboss_web_server:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA92F617-DC78-46F8-9742-1A335E261A6B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/06/11/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:36839",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:37390",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-49875",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488309",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}