CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65432?
The severity of CVE-2026-65432 is rated at 56, indicating a moderate risk level.
How does CVE-2026-65432 affect Apache CXF?
CVE-2026-65432 affects Apache CXF by allowing XML External Entity (XXE) injection through WSDL/XSD import parsing.
What are the potential impacts of CVE-2026-65432?
The potential impacts of CVE-2026-65432 include data exposure, denial of service, and possible remote code execution.
How do I fix CVE-2026-65432?
To fix CVE-2026-65432, it is recommended to update to the latest version of Apache CXF that mitigates XXE vulnerabilities.
What should I do if I cannot update to a fixed version for CVE-2026-65432?
If unable to update, consider disabling WSDL/XSD imports or implement additional input validation to mitigate the risks associated with CVE-2026-65432.