RHLW-2026-69a6c9e577f78fa7: Lightwell Security Advisory: cxf-rt-ws-transfer 3.5.0.rhlw-00003
Red Hat Lightwell has released org.apache.cxf:cxf-rt-ws-transfer 3.5.0.rhlw-00003 with a backported security fix.
CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-ws-transfer 3.5.0 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.apache.cxf:cxf-rt-ws-transferto a version that resolves this vulnerability.Fixed in 3.5.0.rhlw-00003 - Upgrade
Upgrade
org.apache.cxf:cxf-rt-ws-transferto a version that resolves this vulnerability.Fixed in 3.5.0.rhlw-00003
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the org.apache.cxf:cxf-rt-ws-transfer artifact at version 3.5.0 from Maven Central are the relevant population identified by the advisory. The issue affects Apache CXF WS-Transfer functionality.
What does an attacker need to exploit the vulnerability?
The supplied vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction. The advisory identifies the flaw as an XML external entity (XXE) vulnerability.
What is the recommended remediation?
Replace org.apache.cxf:cxf-rt-ws-transfer 3.5.0 with Red Hat Lightwell's org.apache.cxf:cxf-rt-ws-transfer 3.5.0.rhlw-00003. The advisory states that the patched artifact is a drop-in replacement.