CVE-2026-44618
Apache CXF: XXE vulnerability in WS-Transfer functionality
CVE-2026-44618 is a medium vulnerability (CVSS 5.3) in Apache Cxf, published May 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in org.apache.cxf:cxf-rt-ws-transfer 4.2.1.
- Severity
- 5.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.31%EPSS, 24th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.2.1org.apache.cxf:cxf-rt-ws-transfer +7 more
Description
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-ws-transferMaven | 4.2.0 to 4.2.0 | 4.2.1 |
org.apache.cxf:cxf-rt-ws-transferMaven | 4.1.0 up to 4.1.6 | 4.1.6 |
org.apache.cxf:cxf-rt-ws-transferMaven | before 3.6.11 | 3.6.11 |
org.apache.cxf:cxf-rt-ws-transferMaven | 4.2.0 up to 4.2.1 | 4.2.1 |
org.apache.cxf:cxf-rt-ws-transferMaven | 4.1.0 up to 4.1.6, plus listed versions 4.1.14.1.24.1.34.1.44.1.5 | 4.1.6 |
org.apache.cxf:cxf-rt-ws-transferMaven | before 3.6.11, plus listed versions 3.2.03.2.13.2.103.2.113.2.12 Show 45 moreShow less3.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.93.4.03.4.13.4.103.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.03.5.13.5.103.5.113.5.23.5.33.5.43.5.53.5.63.5.7 | 3.6.11 |
org.apache.cxf:cxf-rt-ws-transferRed Hat Lightwell:Maven | before 3.5.1.rhlw-00004, plus listed versions 3.2.03.2.13.2.103.2.113.2.12 Show 37 moreShow less3.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.93.4.03.4.13.4.103.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.03.5.1 | 3.5.1.rhlw-00004 |
org.apache.cxf:cxf-rt-ws-transferRed Hat Lightwell:Maven | before 3.5.0.rhlw-00003, plus listed versions 3.2.03.2.13.2.103.2.113.2.12 Show 36 moreShow less3.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.93.4.03.4.13.4.103.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.0 | 3.5.0.rhlw-00003 |
What each source reports
CVE List Score used
Apache CXF: XXE vulnerability in WS-Transfer functionality
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
CVE-2026-44618- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2026-31434
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
EUVD-2026-31434- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vmm5-fjgx-2jhp
Apache CXF's WS-Transfer module has an insecure XML parser configuration
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
GHSA-vmm5-fjgx-2jhp- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
CVE-2026-44618- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Apache CXF: XXE vulnerability in WS-Transfer functionality
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
CVE-2026-44618- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-07
OSVGHSA-vmm5-fjgx-2jhp
Apache CXF's WS-Transfer module has an insecure XML parser configuration
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
GHSA-vmm5-fjgx-2jhp- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVRHLW-2026-5a2aa5716545640a
Lightwell Security Advisory: cxf-rt-ws-transfer 3.5.1.rhlw-00004
Red Hat Lightwell has released org.apache.cxf:cxf-rt-ws-transfer 3.5.1.rhlw-00004 with a backported security fix.
CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-ws-transfer 3.5.1 from Maven Central.
- Record
RHLW-2026-5a2aa5716545640a- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-13
OSVRHLW-2026-69a6c9e577f78fa7
Lightwell Security Advisory: cxf-rt-ws-transfer 3.5.0.rhlw-00003
Red Hat Lightwell has released org.apache.cxf:cxf-rt-ws-transfer 3.5.0.rhlw-00003 with a backported security fix.
CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality
This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-ws-transfer 3.5.0 from Maven Central.
- Record
RHLW-2026-69a6c9e577f78fa7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7
openwall.com/lists/oss-security/2026/05/22/8
nvd.nist.gov/vuln/detail/CVE-2026-44618
github.com/advisories/GHSA-vmm5-fjgx-2jhp
repo.maven.apache.org/maven2
Left out here: 13 versions. The JSON record has them.