Apache CXF: Untrusted JMS configuration can lead to RCE

CAO 7.5CVE-2026-44417 · GHSA-2hvc-5c6v-f533 · Công bố 22/05/2026 · cập nhật 23/07/2026

Tóm tắt nhanh

CVE-2026-44417 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng org.apache.cxf:cxf-rt-transports-jms, cxf (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.66%, cao hơn 51.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.1.6, 4.2.1, 3.6.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.cxf:cxf-rt-transports-jms Maven	`≥ 4.1.0, < 4.1.6≥ 4.2.0, < 4.2.1< 3.6.11`	`4.1.64.2.13.6.11`
cxf apache	`= 4.2.0≥ 4.0.0, < 4.1.6< 3.6.11`	`4.1.63.6.11`

Mô tả

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Mô tả của NVD

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.