org.apache.cxf:cxf-rt-rs-security-jose-jaxrs vulnerabilities (TuxCare)
13 vulnerabilities.
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: XXE via WSDL/XSD import parsing7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: Denial of service via message header attachments7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: No default restriction on the amount of form parameters per message7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: No restriction on attachment headers per message7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry6.5 Mediumorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl8.1 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8 Criticalorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService4.8 Mediumorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)7.5 Highorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: LDAP Injection vulnerability in XKMS LDAP Repository9.8 Criticalorg.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCareApache CXF: Untrusted JMS configuration can lead to RCE9.8 Critical