medium5.3
CVE-2026-44618
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.
Impact
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.cxf:cxf-rt-ws-transfer | = 4.2.0 | 4.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Cxf | before 3.6.11 from 4.0.0 before 4.1.6 Version 4.2.0 |