You are viewing a plain text version of this content. The canonical link for it is here.
- CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:52:54 UTC, 0 replies.
- CVE-2026-79650: Apache CXF: OIDC RP Open Redirect - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:56:20 UTC, 0 replies.
- CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:57:13 UTC, 0 replies.
- CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:59:48 UTC, 0 replies.
- CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:02:25 UTC, 0 replies.
- CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:05:00 UTC, 0 replies.
- CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:06:03 UTC, 0 replies.
- CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:06:42 UTC, 0 replies.
- CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:10:49 UTC, 0 replies.
- Question on affected-version data for CXF CVEs fixed in 3.6.12 - posted by Venkateswara Adithya Kumar Obilisetty via users <us...@cxf.apache.org> on 2026/10/14 18:33:15 UTC, 1 replies.