When Apache CXF goes EOL, the CVEs don't stop.
Supported Versions: 3.4, 3.5
If your applications run on Apache CXF 3.4 or 3.5, which are now end of life, Never-Ending Support (NES) keeps them running, secure, compliant and audit-ready after upstream stops shipping patches. No migration, no code changes, no new version to adopt.
TRUSTED BY ENTERPRISE
Security, compliance, and continuity -- solved together
With our secure drop-in replacement for end-of-life versions of Apache CXF, your scanners stop flagging CVEs in end-of-life Apache CXF versions for good.
Security
Apache CXF 3.4.x and 3.5.x no longer receive upstream security fixes. NES publishes maintained builds so new CVEs in the framework get patched instead of accumulating.
SLA-backed patch delivery tied to severity
HeroDevs is an authorized CVE Numbering Authority that discloses discovered vulnerabilities
Compliance
Every NES for Apache CXF release ships with HeroDevs VEX statements, one per CVE, naming the exact artifact and version that carries the fix.
SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001, NIS2 and more
Documented patch history for auditors
Business continuity
Every maintained version of Apache CXF requires at least Java 11, and 4.x also requires moving to the jakarta.* namespace. If your application runs on Java 8, there’s no upstream version to move to. NES keeps it supported while you migrate.
Months or years of runway to migrate right
A fraction of migration cost or the cost of a breach.
Apache CXF 3.4 and 3.5 no longer receive upstream releases. The last 3.5 patch was 3.5.11 in March 2025, the last 3.4 patch was 3.4.10 in December 2022, and every CXF security advisory published since then carries fixes only for 3.6 and 4.x. Both lines now carry unpatched CVEs in their final upstream release.
Every patch we ship has a published CVE entry
HeroDevs is an authorized CVE Numbering Authority (CNA), empowered by the CVE Program to discover and assign CVE IDs to security vulnerabilities discovered by HeroDevs.
Every NES for Apache CXF release ships with HeroDevs VEX statements, one per CVE, naming the exact artifact and version that carries the fix.
If you're running legacy Apache CXF versions today, your applications are exposed to the vulnerabilities below. NES for Apache CXF fixes them in minutes.
What NES for Apache CXF publishes
Every org.apache.cxf runtime, transport, security, tooling and integration artifact that upstream published for 3.4.10 and 3.5.11 is published under the NES coordinates. Test harnesses, archetypes and OSGi integration tests are not customer-facing and are not shown.
Core and transports
cxf-core
cxf-rt-transports-http
cxf-rt-transports-jms
cxf-rt-transports-http-netty-client
cxf-rt-transports-http-jetty
cxf-rt-transports-http-undertow
SOAP and WS-*
cxf-rt-frontend-jaxws
cxf-rt-bindings-soap
cxf-rt-databinding-jaxb
cxf-rt-wsdl
cxf-rt-ws-security
cxf-rt-ws-rm
cxf-rt-ws-transfer
cxf-services-sts-core
REST and JAX-RS security
cxf-rt-frontend-jaxrs
cxf-rt-rs-client
cxf-rt-rs-security-oauth2
cxf-rt-rs-security-sso-oidc
cxf-rt-rs-security-jose-jaxrs
cxf-rt-rs-security-xml
cxf-rt-rs-extension-search
Integration
cxf-spring-boot-starter-jaxws
cxf-spring-boot-starter-jaxrs
cxf-spring-boot-autoconfigure
cxf-integration-cdi
cxf-integration-jca
Build tooling
cxf-codegen-plugin
cxf-java2ws-plugin
cxf-wadl2java-plugin
cxf-wsdl-validator-plugin
A defensible answer for every standard, framework, or regulation.
EOL software undermines patch-management expectations across regulations worldwide. NES gives you a maintained, vendor-backed build with committed SLAs and a documented patch history to demonstrate compliance to auditors and regulators.
PCI DSS
Req. 6.3.3 requires known critical and high-severity vulnerabilities to be patched within 30 days. EOL Apache CXF with no upstream patch puts you out of compliance. NES restores the patch path.
HIPAA
Unsupported frameworks make it hard to show reasonable safeguards for systems handling ePHI. NES provides active maintenance and risk reduction.
SOC 2
Trust Services Criteria expect timely vulnerability remediation and patch management. EOL dependencies raise material findings during audit unless a compensating support path exists. NES is that support path.
NIS2
Article 21 covers patching, vulnerability, and supply-chain management. Running EOL software without a maintained support path creates risk that NIS2 expects operators to actively mitigate.
DORA
DORA treats EOL software as a resilience gap for financial ICT assets. NES gives you a maintained build and a documented patch-management program.
Cyber Resilience Act
Governs software lifecycle security for products with digital elements. NES gives you a maintained, patched build for your EOL Apache CXF line during the coverage period.
NIST CSF 2.0
Control PR.PS-02 requires organizations to actively maintain or remove vulnerable software based on risk. NES enables compliance without a forced upgrade.
FedRAMP
Continuous monitoring expects flaw remediation on a defined cadence. A patched, vendor-backed build gives your ISSO the documented remediation path to justify keeping EOL Apache CXF in the authorization boundary.
Commercial Contracts
Vulnerability and configuration management controls require identifying technical vulnerabilities and keeping software within secure standards. NES restores that posture for EOL software.
We collaborate with open-source engineers and ecosystem contributors to ensure our Never-Ending Support products are the same quality you've come to expect from the originals.
By involving engineers with deep project expertise, we set a new standard in open-source software maintenance to ensure that NES for Apache CXF is as dependable as the upstream technology it's built on.
We Give Back to Open Source
Open source maintainers do critical work, but rarely get paid for it.
HeroDevs is putting $20 million toward changing that — funding the creators and projects that keep the ecosystem running, with grants from $2,500 to $250,000.
We’ve written patches for unmaintained codebases, tracked down vulnerabilities where no one else was looking, and kept critical systems running safely without rushed rewrites. This fund builds on that work, so maintainers can keep doing what they do best.
Frequently Asked Questions
Resources
View All Articles
Contact Us
Got questions about Never-Ending Support for your open-source library? We're here to help!
Discover how HeroDevs NES Products can keep your systems secure and compliant.
Learn how our solutions can deliver value to your organization.
Get detailed pricing information tailored to your needs.
