{"id":"CVE-2026-65432","aliases":["CLSA-2026-1793898246","CLSA-2026-1793982274","CLSA-2026-1794008495","CLSA-2026-1794218709","EUVD-2026-53856","GHSA-jvhw-7q2c-2r65"],"status":"published","title":"Apache CXF: XXE via WSDL/XSD import parsing","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00652,"percentile":0.51689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2026-08-06T10:26:12Z","modified":"2026-11-09T19:15:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-integration-jca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-transports-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/06/17","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65432","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jvhw-7q2c-2r65"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65432.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-65432","title":"Apache CXF: XXE via WSDL/XSD import parsing","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T10:26:12.142Z","modified":"2026-08-07T00:01:48.075Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-53856","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T10:26:12Z","modified":"2026-08-07T00:01:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-jvhw-7q2c-2r65","title":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs...","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T12:31:13Z","modified":"2026-08-07T00:32:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:10:11.041675Z"}],"nvd":[{"id":"CVE-2026-65432","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:16:30.463Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-65432","title":"Apache CXF: XXE via WSDL/XSD import parsing","description":"Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any \u003cwsdl:import\u003e or \u003cxsd:import\u003e referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T10:26:12.142Z","modified":"2026-10-28T02:31:13.899488907Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"CLSA-2026-1793898246","title":"TuxCare security update for org.apache.cxf (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.11.","status":"published","published":"2026-11-05T18:04:07Z","modified":"2026-11-06T13:15:13.999108Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793982274","title":"TuxCare security update for org.apache.cxf (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.9-tuxcare.12.","status":"published","published":"2026-11-06T17:24:35Z","modified":"2026-11-06T19:00:05.26274921Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794008495","title":"TuxCare security update for 8 packages (12 CVEs)","description":"TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.","status":"published","published":"2026-11-07T00:41:36Z","modified":"2026-11-07T07:15:03.24809114Z","updated_at":"2026-11-07T07:40:28.517244Z"},{"id":"CLSA-2026-1794218709","title":"TuxCare security update for org.apache.cxf (7 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 7 CVEs. Fixed in 3.0.12-tuxcare.1.","status":"published","published":"2026-11-09T11:05:10Z","modified":"2026-11-09T19:15:02.890791072Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}