VULNERABILITY INTELLIGENCE

CVE-2025-48913

CVSS score9.8 CRITICAL
EPSS probability1.07%
CISA KEVNot currently listed
Published2025-08-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Weakness classification

  • security@apache.org: CWE-20
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references