GHSA-93g8-qqv3-mrx8: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Q: Who is exposed to this issue?

Apache CXF deployments are exposed if untrusted users are allowed to configure JMS for Apache CXF. The issue can provide code-execution capabilities in that scenario.

Q: What does an attacker need to exploit it?

An attacker needs the ability to supply or control JMS configuration that Apache CXF processes. No authentication or user interaction is required according to the listed severity vector, but exploitation has high attack complexity.

Q: Which versions address the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions are identified as fixing the vulnerability.

Published Jun 12, 2026

Updated

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected Software

1 affected component

Apache CXF<4.2.2, <4.1.7, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·09:00 AM

Data Sourced

via OSV·09:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache CXF deployments are exposed if untrusted users are allowed to configure JMS for Apache CXF. The issue can provide code-execution capabilities in that scenario.

What does an attacker need to exploit it?

An attacker needs the ability to supply or control JMS configuration that Apache CXF processes. No authentication or user interaction is required according to the listed severity vector, but exploitation has high attack complexity.

Which versions address the issue?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions are identified as fixing the vulnerability.

GHSA-93g8-qqv3-mrx8: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions address the issue?