CLSA-2026-1794218709: TuxCare security update for org.apache.cxf (7 CVEs)
Published Nov 9, 2026
·Updated
TuxCare rebuilt 3 org.apache.cxf packages to address 7 CVEs. Fixed in 3.0.12-tuxcare.1.
Affected Software
3 affected componentsFixes available
tuxcare/org.apache.cxf:cxf-core>=3.0.12<3.0.12-tuxcare.1
3.0.12-tuxcare.1
tuxcare/org.apache.cxf:cxf-rt-frontend-jaxrs>=3.0.12<3.0.12-tuxcare.1
3.0.12-tuxcare.1
tuxcare/org.apache.cxf:cxf-rt-wsdl>=3.0.12<3.0.12-tuxcare.1
3.0.12-tuxcare.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tuxcare/org.apache.cxf:cxf-coreto a version that resolves this vulnerability.Fixed in 3.0.12-tuxcare.1 - Upgrade
Upgrade
tuxcare/org.apache.cxf:cxf-rt-frontend-jaxrsto a version that resolves this vulnerability.Fixed in 3.0.12-tuxcare.1 - Upgrade
Upgrade
tuxcare/org.apache.cxf:cxf-rt-wsdlto a version that resolves this vulnerability.Fixed in 3.0.12-tuxcare.1 - Upgrade
Upgrade
org.apache.cxfto a version that resolves this vulnerability.Fixed in 3.0.12-tuxcare.1
Event History
Nov 9, 2026
Advisory Published
via OSV·11:05 AM
Data Sourced
via OSV·11:05 AM
DescriptionAffected Software
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
Which packages are covered by this update?
The update covers cxf-core, cxf-rt-frontend-jaxrs, and cxf-rt-wsdl under tuxcare/org.apache.cxf.
2
What version includes the fixes?
The 7 CVE fixes are included in version 3.0.12-tuxcare.1.