Apache CXF's WS-Transfer module has an insecure XML parser configuration

MEDIO 5.3CVE-2026-44618 · GHSA-vmm5-fjgx-2jhp · Published 22/05/2026 · updated 23/07/2026

En resumen

CVE-2026-44618 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a org.apache.cxf:cxf-rt-ws-transfer, cxf (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.31%, mayor que el 24.3% de las vulnerabilidades.
Solución: actualizar a 4.1.6, 4.2.1, 3.6.11 o posterior.

Package	Affected versions	Patched versions
org.apache.cxf:cxf-rt-ws-transfer Maven	`≥ 4.1.0, < 4.1.6≥ 4.2.0, < 4.2.1< 3.6.11`	`4.1.64.2.13.6.11`
cxf apache	`= 4.2.0≥ 4.0.0, < 4.1.6< 3.6.11`	`4.1.63.6.11`

Description

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-44618 · ADVISORY
apache/cxf · PACKAGE
lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7 · WEB
openwall.com/lists/oss-security/2026/05/22/8 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free