REDHAT-BUG-2511981: High severity Apache CXF vulnerability

Q: What must an attacker control to exploit this issue?

An attacker needs to cause Apache CXF to process a WSDL that imports another WSDL or XSD document containing a DOCTYPE declaration or external entity. The top-level WSDL alone is handled by hardened parsing; the exposure is in imported documents processed by WSDL4J.

Q: Are all XML documents processed by Apache CXF affected?

The described issue specifically concerns imported WSDL and XSD content referenced through wsdl:import or xsd:import. The hardened StaxUtils path protects the top-level WSDL by disabling DTDs and external entities.

Q: Which versions contain the fix?

Upgrade to Apache CXF version 4.2.3, 4.1.8, or 3.6.12. These versions fix the handling of imported WSDL and XSD documents.

Published Aug 6, 2026

Updated

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected Software

1 affected component

Apache CXF<4.2.3, <4.1.8, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.3

Event History

Aug 6, 2026

Data Sourced

via Red Hat·11:11 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control to exploit this issue?

An attacker needs to cause Apache CXF to process a WSDL that imports another WSDL or XSD document containing a DOCTYPE declaration or external entity. The top-level WSDL alone is handled by hardened parsing; the exposure is in imported documents processed by WSDL4J.

Are all XML documents processed by Apache CXF affected?

The described issue specifically concerns imported WSDL and XSD content referenced through wsdl:import or xsd:import. The hardened StaxUtils path protects the top-level WSDL by disabling DTDs and external entities.

Which versions contain the fix?

Upgrade to Apache CXF version 4.2.3, 4.1.8, or 3.6.12. These versions fix the handling of imported WSDL and XSD documents.

REDHAT-BUG-2511981: High severity Apache CXF vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to exploit this issue?

Are all XML documents processed by Apache CXF affected?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to exploit this issue?

Are all XML documents processed by Apache CXF affected?

Which versions contain the fix?