GHSA-vmm5-fjgx-2jhp: Apache CXF: XXE vulnerability in WS-Transfer functionality

Q: What must an attacker be able to do to exploit this issue?

An attacker needs network access to a WS-Transfer endpoint that processes attacker-controlled XML. No authentication or user interaction is required according to the supplied CVSS vector.

Q: What is the likely impact of successful exploitation?

The issue may allow XML external entity processing, with a low confidentiality impact. The supplied data does not indicate integrity or availability impact.

Q: Which Apache CXF releases contain the fix?

Upgrade to Apache CXF 4.2.1, 4.1.6, or 3.6.11. The provided information does not identify other mitigations for environments that cannot upgrade immediately.

Published May 22, 2026

Updated

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Affected Software

1 affected component

Apache CXF<4.2.1, <4.1.6, <3.6.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.1
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.6
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.11

Event History

May 22, 2026

CVE Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker needs network access to a WS-Transfer endpoint that processes attacker-controlled XML. No authentication or user interaction is required according to the supplied CVSS vector.

What is the likely impact of successful exploitation?

The issue may allow XML external entity processing, with a low confidentiality impact. The supplied data does not indicate integrity or availability impact.

Which Apache CXF releases contain the fix?

Upgrade to Apache CXF 4.2.1, 4.1.6, or 3.6.11. The provided information does not identify other mitigations for environments that cannot upgrade immediately.

GHSA-vmm5-fjgx-2jhp: Apache CXF: XXE vulnerability in WS-Transfer functionality

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the likely impact of successful exploitation?

Which Apache CXF releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the likely impact of successful exploitation?

Which Apache CXF releases contain the fix?