CVE-2026-50633
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50633- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-36401
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
EUVD-2026-36401- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qp3f-rvj8-46c8
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-qp3f-rvj8-46c8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-502
- Updated
- 2026-11-02
NVD
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50633- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-502
- Updated
- 2026-11-05
OSV
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Record
CVE-2026-50633- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-07
OSVGHSA-qp3f-rvj8-46c8
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
- Record
GHSA-qp3f-rvj8-46c8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1787867443 No score
TuxCare security update for org.apache.cxf (4 CVEs)
TuxCare rebuilt 4 org.apache.cxf packages to address 4 CVEs. Fixed in 3.5.9-tuxcare.7.
- Record
CLSA-2026-1787867443- Updated
- 2026-11-02
OSVCLSA-2026-1788474736 No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 4 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.9.
- Record
CLSA-2026-1788474736- Updated
- 2026-11-02
OSVCLSA-2026-1794008495 No score
TuxCare security update for 8 packages (12 CVEs)
TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1794008495- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-integration-jcaMaven |
4.2.0 up to 4.2.2 | 4.2.2 |
org.apache.cxf:cxf-integration-jcaMaven |
before 4.1.7 | 4.1.7 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 4 CVEs |
3.5.9 up to 3.5.9-tuxcare.7, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9.tuxcare.1 |
3.5.9-tuxcare.7 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-integration-jcaMaven |
4.2.0 up to 4.2.2, plus listed versions 4.2.1 |
4.2.2 |
org.apache.cxf:cxf-integration-jcaMaven |
before 4.1.7, plus listed versions 2.0.102.0.112.0.122.0.132.0.6 Show 45 moreShow less2.0.72.0.82.0.92.12.1.12.1.102.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.22.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.22.4.32.4.4 |
4.1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| facts, products, references | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50633 is a high vulnerability (CVSS 8.1) in Apache Cxf, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in org.apache.cxf:cxf-integration-jca 4.2.2.
References
Left out here: 176 versions. The JSON record has them.