REDHAT-BUG-2488309: High severity Apache Apache CXF vulnerability
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXF (EndpointReferenceUtils / W3CMultiSchemaFactory)to a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXF (EndpointReferenceUtils / W3CMultiSchemaFactory)to a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488309?
The severity of REDHAT-BUG-2488309 is classified as high, with a rating of 7.
How do I fix REDHAT-BUG-2488309?
To fix REDHAT-BUG-2488309, users should upgrade to Apache CXF version 4.2.2 or 4.1.7.
What vulnerability does REDHAT-BUG-2488309 address?
REDHAT-BUG-2488309 addresses an issue with external entity resolution due to improper SAXParserFactory configurations in Apache CXF.
What are the affected components in REDHAT-BUG-2488309?
The affected components in REDHAT-BUG-2488309 are the EndpointReferenceUtils and W3CMultiSchemaFactory classes.
When was REDHAT-BUG-2488309 published?
REDHAT-BUG-2488309 was published on June 12, 2026.