GHSA-qp3f-rvj8-46c8: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Published Jun 12, 2026
·Updated
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected Software
1 affected component
Apache CXF<4.2.2, <4.1.7, <3.6.12
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.7 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Jun 12, 2026
CVE Published
via OSV·09:02 AM
Data Sourced
via OSV·09:02 AM
DescriptionSeverityWeakness