CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12 - Configuration
Ensure CXF JMS transport does not deserialize inbound JMS ObjectMessage bodies using native Java deserialization; the fix disables ObjectMessage deserialization by default and provides a configuration switch to re-enable it only if strictly required.
Apache CXF JMS transport ObjectMessage deserialization = disabled by default
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66909?
CVE-2026-66909 has a risk score of 77, indicating it is a high severity vulnerability.
How do I fix CVE-2026-66909?
To mitigate CVE-2026-66909, implement strict type checking and validation for the deserialization process in Apache CXF.
What effect could CVE-2026-66909 have on an application?
CVE-2026-66909 allows attackers to perform denial of service or execute malicious code through crafted JMS ObjectMessages.
Which versions of Apache CXF are affected by CVE-2026-66909?
CVE-2026-66909 affects all versions of Apache CXF that utilize JMS transport for message deserialization.
Is there a workaround for CVE-2026-66909?
A potential workaround for CVE-2026-66909 is to disable the acceptance of ObjectMessages or restrict the JMS message sources.