Apache CXF 3.4 and 3.5 End of Life: 31 Unpatched CVEs and the Fix

Drop-in security support for end-of-life Apache CXF 3.4 and 3.5, covering the 2026 vulnerability wave that upstream fixes never reached.

HeroDevs has launched NES for Apache CXF, bringing Never-Ending Support (NES) to the CXF 3.4 and 3.5 release lines. Apache CXF is the open-source services framework behind a huge share of enterprise Java SOAP and REST integrations: it powers JAX-WS and JAX-RS endpoints in everything from standalone Spring applications to the integration platforms and middleware stacks built on top of it. If your organization exposes or consumes web services from a Java application that predates the Jakarta namespace migration, there is a good chance CXF is in the call path.

That matters right now because 2026 has been the roughest year in CXF's security history. Apache disclosed 26 CXF CVEs in 2026, and the fixes landed only in the 3.6.12, 4.1.8, and 4.2.3 releases. For applications still running CXF 3.4 or 3.5, none of those fixes apply. The HeroDevs vulnerability directory now tracks 31 CXF CVEs in total, 11 of them rated Critical in the directory and every one of them is remediated in NES for Apache CXF.

Running Apache CXF 3.4 or 3.5? See NES for Apache CXF.

The Apache CXF end-of-life picture, briefly

Apache CXF maintains a small set of active branches. As of October 2026 that means 4.2.x, 4.1.x, and 3.6.x, per the official download page. Apache publishes no formal EOL schedule for CXF; a branch is done when it stops receiving releases. By that measure 3.4 has been end of life since 3.4.10 shipped in December 2022, and 3.5 since 3.5.11 shipped in March 2025. Every vulnerability disclosed since then is permanently unfixed on those branches. No OSS fix is available, and none is coming.

What happened with Apache CXF vulnerabilities in 2026

The year's disclosures cluster around two parts of the framework, and both clusters hit hard.

The JMS transport produced a chain of remote code execution bugs. It started with CVE-2025-48913, a Critical (CVSS 9.8) JNDI injection: an attacker who can influence JMS configuration can point the JNDI provider URL at a malicious rmi:// or ldap:// server and execute arbitrary code, the same class of attack that made Log4Shell infamous. The fix turned out to be incomplete, producing CVE-2026-44417. Then CVE-2026-66909 added a second Critical RCE in the same transport via unsafe deserialization of inbound JMS ObjectMessage payloads, and CVE-2026-50632 and CVE-2026-50633 rounded out the set with further JNDI injection paths in JMSConfigFactory and the JCA integration. Five RCE-class vulnerabilities in one transport in roughly a year.

The OAuth2 and OIDC modules took a dozen separate hits. If you use CXF's cxf-rt-rs-security-oauth2 or OIDC modules as an authorization server or token validator, the 2026 batch broke nearly every stage of the token lifecycle: authorization codes that can be replayed (CVE-2026-68079, CVSS 9.8, and CVE-2026-57818), an inverted IP binding check that rejects the legitimate caller while admitting everyone else (CVE-2026-50628, CVSS 9.8), self-issued ID tokens accepted without claim validation (CVE-2026-65583), JWT claims able to silently override PKCE and nonce parameters (CVE-2026-63687), missing audience and issuer validation (CVE-2026-50627), scope self-escalation through dynamic client registration (CVE-2026-61466), revoked tokens that keep working (CVE-2026-68481), a race condition in refresh token processing (CVE-2026-50631), and more.

Beyond those two clusters, 2026 also brought XML external entity (XXE) flaws in WSDL/XSD import parsing and core utilities, LDAP injection in the XKMS certificate repository, signature forgery in JOSE request handling, HTTP response splitting, and a run of denial-of-service bugs in attachment and form-parameter handling. The full list is below.

Which Apache CXF CVEs apply to you?

Thirty-one CVEs is the catalog, not your exposure. CXF is modular, and most of the 2026 wave lands in specific modules. Start with an inventory: mvn dependency:tree -Dincludes=org.apache.cxf (or gradle dependencies | grep cxf for Gradle builds), then map what you actually ship:

You ship	What applies
cxf-rt-transports-jms or cxf-integration-jca	The RCE chain: CVE-2025-48913, CVE-2026-44417, CVE-2026-66909, CVE-2026-50632, CVE-2026-50633
cxf-rt-rs-security-oauth2 or cxf-rt-rs-security-sso-oidc	The token lifecycle cluster: the 12 authorization and authentication CVEs in the table below
JAX-RS or JAX-WS endpoints only	The core set: the XXE, SSRF, and denial-of-service entries in attachment, form-parameter, and WSDL/XSD handling

Most teams will find a subset applies rather than all 31. The remediation path is the same either way, but knowing which rows are yours is what turns the table below into a checklist.

What NES for Apache CXF covers

NES for Apache CXF is a secure, drop-in replacement for the 3.4 and 3.5 release lines. Security fixes land on HeroDevs-maintained forks and publish under NES coordinates through the HeroDevs registry, so adopting it is a dependency swap, not a migration. No API changes, no Jakarta namespace rewrite, no forced jump to 4.x. Every CVE in the table below is resolved in the current NES releases. Installation and configuration details are in the NES for Apache CXF documentation.

Every Apache CXF CVE in the HeroDevs vulnerability directory

All 31 CXF entries in the vulnerability directory, sorted by severity. Severity labels are the HeroDevs vulnerability directory's ratings; follow each CVE link for the underlying advisory and scoring detail. Affected ranges are the upstream OSS versions; all listed vulnerabilities are remediated in NES for Apache CXF 3.4 and 3.5.

CVE	Severity	Module	Vulnerability	Affected (upstream OSS)
CVE-2026-68079	Critical	OAuth2	Authorization code replay in DefaultEncryptingCodeDataProvider	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-66909	Critical	JMS transport	Unsafe deserialization of inbound JMS ObjectMessage, remote code execution	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-65583	Critical	OIDC	Self-issued ID token claims validation skipped	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-63687	Critical	OAuth2/OIDC	JwtRequestCodeFilter silently overrides PKCE and nonce parameters	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-61466	Critical	OAuth2	Dynamic client registration scope self-escalation	>=3.1.8 <3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-50628	Critical	OAuth2	Inverted IP binding check defeats security control	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50627	Critical	OAuth2	Missing JWT audience and issuer validation in access token validator	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-49875	Critical	Core	XXE injection in W3CMultiSchemaFactory and EndpointReferenceUtils	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-44930	Critical	XKMS	LDAP injection in the LdapCertificateRepo certificate repository	<3.6.11, >=4.0.0 <4.1.6, >=4.2.0 <4.2.1
CVE-2025-48913	Critical	JMS transport	JNDI injection via untrusted JMS configuration, remote code execution	<3.6.8, >=4.0.0 <4.0.9, >=4.1.0 <4.1.3
CVE-2024-28752	Critical	Aegis databinding	Server-side request forgery	<3.5.8, >=3.6.0 <3.6.3, >=4.0.0 <4.0.4
CVE-2026-68481	High	OAuth2	Revoked tokens remain active in DefaultEncryptingOAuthDataProvider	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-65432	High	WSDL/XSD parsing	XXE via WSDL/XSD import parsing	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-64958	High	Attachments	Denial of service via message header attachments	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-57819	High	REST frontend	Denial of service, no default restriction on form parameters	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-57818	High	OAuth2	Authorization code replay via TOCTOU in JCacheCodeDataProvider	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-57817	High	OIDC	Authorization code hash not enforced in hybrid flow	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-54225	High	Attachments	Denial of service via large attachments	<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
CVE-2026-50645	High	Attachments	Denial of service, no restriction on attachment headers	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50633	High	JCA integration	JNDI injection in DispatchMDBMessageListenerImpl, remote code execution	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50632	High	JMS transport	JNDI injection in JMSConfigFactory, remote code execution	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50631	High	OAuth2	TOCTOU race condition in refresh token processing	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-44417	High	JMS transport	Incomplete fix of CVE-2025-48913, remote code execution	<3.6.11, >=4.0.0 <4.1.6, >=4.2.0 <4.2.1
CVE-2025-23184	High	Core	Denial of service via temporary files	<3.5.10, >=3.6.0 <3.6.5, >=4.0.0 <4.0.6
CVE-2024-29736	High	WADL service description	Server-side request forgery via WADL stylesheet parameter	<3.5.9, >=3.6.0 <3.6.4, >=4.0.0 <4.0.5
CVE-2026-50634	Medium	JOSE	Signature forgery, JSON request filter trusts the first signature entry unvalidated	>=3.0.3 <3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50630	Medium	HTTP	Response splitting via WWW-Authenticate realm injection	<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50629	Medium	OAuth2	Log injection via unsanitized client identifier	>=3.1.7 <3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-50623	Medium	OAuth2	Authentication bypass in TokenIntrospectionService	>=3.1.5 <3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
CVE-2026-44618	Medium	WS-Transfer	XXE in WS-Transfer functionality	<3.6.11, >=4.0.0 <4.1.6, >=4.2.0 <4.2.1
CVE-2024-32007	Medium	JOSE	Denial of service in JOSE processing	<3.5.9, >=3.6.0 <3.6.4, >=4.0.0 <4.0.5

Taking action on Apache CXF 3.4 and 3.5

If you are on CXF 3.6 or 4.x, upgrade to 3.6.12, 4.1.8, or 4.2.3 and stay current with upstream. If you are on 3.4 or 3.5, there is no upstream path short of a major-version migration, and the vulnerabilities above are live in your stack today. NES for Apache CXF resolves all of them as a drop-in replacement, so you can secure what you run now and migrate on your own schedule. Talk to HeroDevs to get started.

Share via:

Table of Contents

Read full article

Author

Greg Allen

Chief Technology Officer

Open Source Insights Delivered Monthly

Subscribe via RSS

Thanks for signing up for our Newsletter! We look forward to connecting with you.

Oops! Something went wrong while submitting the form.

Resources

View All Articles

EOL Software

October 9, 2026

Apache CXF Versions, EOL Dates, and Latest Releases (October 2026)

As of October 2026, the latest Apache CXF release is 4.2.3, the maintained lines are 4.2.x, 4.1.x and 3.6.x; 4.0.x and 3.5.x are end of life.

Security

October 8, 2026

CVE-2026-49364, CVE-2026-27446 & 8 More: Apache ActiveMQ Artemis 2026 CVE Round-Up

How ten 2026 advisories, led by pre-authentication flaws present since Artemis 1.0.0, leave every release before 2.57.0 exposed, with no upstream path for any Spring Boot pin.

Announcements

October 8, 2026

HeroDevs Never-Ending Support (NES) for Spring Boot Managed Dependencies

HeroDevs Never-Ending Support (NES) for Spring now extends to the managed dependencies that ship inside Spring Boot. If your application is pinned to an end-of-life Spring Boot line and your scanner is flagging a CVE in one of the libraries Spring manages for you, there is now a remediation path that does not require re-architecting your build or rushing a major-version migration. We are rolling this out for both the Spring Boot 2.7 and 3.5 lines, both of which are now past open source end of life: 2.7 since 2023, and 3.5 since 2026. This is worth a few minutes even if you know Spring well. Managed dependencies are the part of the dependency graph most teams cannot cleanly account for. When a library in that set stops receiving security fixes, each new CVE disclosed against the library stays open in production, with no upstream patch coming.