CVE-2026-49875: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
Other sources
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.7 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49875?
CVE-2026-49875 has a critical severity rating of 9.8 according to the CVSS 3.1 standard.
How do I fix CVE-2026-49875?
To remediate CVE-2026-49875, it is recommended to upgrade to Apache CXF versions 4.2.2 or 4.1.7.
What vulnerabilities does CVE-2026-49875 exploit?
CVE-2026-49875 exploits an XML External Entity (XXE) injection vulnerability in Apache CXF.
Which classes are affected by CVE-2026-49875?
The affected classes in CVE-2026-49875 are W3CMultiSchemaFactory and EndpointReferenceUtils in Apache CXF.
What is the impact of CVE-2026-49875?
The impact of CVE-2026-49875 includes potential data exposure and denial of service due to out-of-band external entity resolution.