VULNERABILITY INTELLIGENCE

CVE-2026-49875

CVSS score9.8 CRITICAL

EPSS probability0.53%

CISA KEVNot currently listed

Published2026-06-12

Last modified2026-10-29

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Weakness classification

security@apache.org: CWE-611
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-611

Primary references

security@apache.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Issue Tracking, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Third Party Advisory