CRITICAL Published June 12, 2026

CVE-2026-49875

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

CVSS base score

9.8 (v3.1)

Severity

CRITICAL

Attack vector

Network

Weakness

CWE-611

Last modified

October 29, 2026

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

apache cxf redhat jboss enterprise application platform redhat build of apache camel redhat fuse redhat jboss web server redhat single sign-on

References

lists.apache.org Vendor Advisory
www.openwall.com Mailing List, Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
access.redhat.com Third Party Advisory
bugzilla.redhat.com Issue Tracking, Third Party Advisory
security.access.redhat.com Third Party Advisory

View full NVD advisory →

More apache vulnerabilities

← Back to CVE watch

CVE-2026-49875

Affected products

References

More apache vulnerabilities

Related reading