GHSA-xf62-wr5p-5p95: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

Q: What must an attacker be able to control to exploit this issue?

The attacker must be able to control the OAuth2 realm value used by AuthorizationUtils when Apache CXF constructs a WWW-Authenticate response header. No authentication or user interaction is required according to the supplied severity vector.

Q: What could exploitation allow?

An attacker-controlled realm containing CR and LF characters can inject arbitrary HTTP headers or split the HTTP response. The reported impact includes limited confidentiality and integrity impact, with no availability impact.

Q: Which versions address the vulnerability?

Upgrade to Apache CXF 4.2.2, 4.1.7, or 3.6.12. These versions are identified as containing the fix.

Published Jun 12, 2026

Updated

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Affected Software

1 affected component

Apache CXF<3.6.12, <4.1.7, <4.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·08:58 AM

Data Sourced

via OSV·08:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

The attacker must be able to control the OAuth2 realm value used by AuthorizationUtils when Apache CXF constructs a WWW-Authenticate response header. No authentication or user interaction is required according to the supplied severity vector.

What could exploitation allow?

An attacker-controlled realm containing CR and LF characters can inject arbitrary HTTP headers or split the HTTP response. The reported impact includes limited confidentiality and integrity impact, with no availability impact.

Which versions address the vulnerability?

Upgrade to Apache CXF 4.2.2, 4.1.7, or 3.6.12. These versions are identified as containing the fix.

GHSA-xf62-wr5p-5p95: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

What could exploitation allow?

Which versions address the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

What could exploitation allow?

Which versions address the vulnerability?