critical9.8
CVE-2025-48913
Apache CXF: Untrusted JMS configuration can lead to RCE
Impact
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.cxf:cxf-rt-transports-jms | < 3.6.8 | 3.6.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Cxf | before 3.6.8 from 4.0.0 before 4.0.9 from 4.1.0 before 4.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
- http://www.openwall.com/lists/oss-security/2025/08/07/2
- https://github.com/advisories/GHSA-g4px-6qhm-hqjm
- https://nvd.nist.gov/vuln/detail/CVE-2025-48913
- https://github.com/apache/cxf/commit/24e50ffeca3132570c2f297c5c7dbd05a1bb1bfa
- https://github.com/mbhatt1/disclosures/security/advisories/GHSA-hv69-h8rg-7jg2