CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Other sources
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import or xsd:import referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65432?
The severity of CVE-2026-65432 is rated at 56, indicating a moderate risk level.
How does CVE-2026-65432 affect Apache CXF?
CVE-2026-65432 affects Apache CXF by allowing XML External Entity (XXE) injection through WSDL/XSD import parsing.
What are the potential impacts of CVE-2026-65432?
The potential impacts of CVE-2026-65432 include data exposure, denial of service, and possible remote code execution.
How do I fix CVE-2026-65432?
To fix CVE-2026-65432, it is recommended to update to the latest version of Apache CXF that mitigates XXE vulnerabilities.
What should I do if I cannot update to a fixed version for CVE-2026-65432?
If unable to update, consider disabling WSDL/XSD imports or implement additional input validation to mitigate the risks associated with CVE-2026-65432.