CVE-2026-44930

Overview

Apache CXF is an open-source services framework, maintained by the Apache Software Foundation, for building and consuming web services in Java. It implements the JAX-WS and JAX-RS APIs and supports SOAP, the WS-* standards, RESTful HTTP, and OAuth 2.0 over transports such as HTTP and JMS. Its modules are published as Maven artifacts under org.apache.cxf.

An Information Exposure vulnerability (CVE-2026-44930) has been identified in the LDAP certificate repository (LdapCertificateRepo) of the Apache CXF XKMS service, which allows attackers to inject LDAP filter and DN syntax through request identifiers and retrieve arbitrary certificates from the repository.

Per OWASP: LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through techniques similar to SQL Injection.

This issue affects versions prior to 3.6.11, versions 4.0.0 through 4.1.5, and version 4.2.0 of Apache CXF.

Details

Module Info

• Product: Apache CXF
• Affected packages: org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap
• Affected versions: <3.6.11, >=4.0.0 <4.1.6, >=4.2.0 <4.2.1
• GitHub repository: https://github.com/apache/cxf
• Published packages: https://central.sonatype.com/artifact/org.apache.cxf.services.xkms/cxf-services-xkms-x509-repo-ldap
• Package manager: Maven
• Fixed in:
• OSS Apache CXF 3.6.11, 4.1.6, 4.2.1
• NES for Apache CXF v3.4.12 and v3.5.13

Vulnerability Info

This Critical-severity vulnerability is found in the cxf-services-xkms-x509-repo-ldap package in versions prior to 3.6.11, versions 4.0.0 through 4.1.5, and version 4.2.0 of Apache CXF.

The XKMS service resolves certificates for Locate and Validate requests by looking them up in a certificate repository. When the LDAP-backed repository is configured, LdapCertificateRepo builds LDAP search filters and distinguished names by formatting caller-supplied identifiers (service name, endpoint, UID, issuer and serial number, subject DN) directly into the query strings. None of the RFC 4515 filter metacharacters (*, (, ), \, NUL) are escaped, and the only DN escaping applied is for the / character:

@Override
public X509Certificate findBySubjectDn(String id) {
    X509Certificate cert = null;
    try {
        String dn = id;
        if (rootDN != null && !rootDN.isEmpty()) {
            dn = dn + "," + rootDN;
        }
        cert = getCertificateForDn(dn);
    } catch (NamingException e) {
        // Not found
    }
    if (cert == null) {
        // Try to find certificate by search for uid attribute
        try {
            cert = getCertificateForUIDAttr(id);
        } catch (NamingException e) {
            // Not found
        }
    }
    return cert;
}

@Override
public X509Certificate findByServiceName(String serviceName) {
    ...
        try {
            String filter = String.format(ldapConfig.getServiceCertUIDTemplate(), serviceName);
            Attribute attr = ldapSearch.findAttribute(rootDN, filter, ldapConfig.getAttrCrtBinary());
            return getCert(attr);
    ...
}

@Override
public X509Certificate findByEndpoint(String endpoint) {
    X509Certificate cert = null;
    String filter = String.format("(%s=%s)", ldapConfig.getAttrEndpoint(), endpoint);
    ...
}

protected String getDnForIdentifier(String id) {
    String escapedIdentifier = id.replaceAll("\\/", Matcher.quoteReplacement("\\/"));
    return String.format(ldapConfig.getServiceCertRDNTemplate(), escapedIdentifier) + "," + rootDN;
}

protected X509Certificate getCertificateForUIDAttr(String uid) throws NamingException {
    String filter = String.format(filterUIDTemplate, uid);
    Attribute attr = ldapSearch.findAttribute(rootDN, filter, ldapConfig.getAttrCrtBinary());
    return getCert(attr);
}

@Override
public X509Certificate findByIssuerSerial(String issuer, String serial) {
    ...
    String filter = String.format(filterIssuerSerialTemplate, issuer, serial);
    ...
}

Because filterUIDTemplate has the form (uid=%s) and filterIssuerSerialTemplate has the form (&(issuer=%s)(serial=%s)) (using the configured UID, issuer and serial number attributes), an identifier such as * or x)(|(uid=* turns an exact-match lookup into a wildcard or attacker-shaped query, and the repository returns whichever certificate the altered filter matches first. Identifiers placed into DNs can likewise add or change RDN components. A client that can send XKMS requests can therefore make the service return certificates it did not ask for by name, and components that trust the XKMS response may use a certificate that does not belong to the requested identity.

This vulnerability was introduced in 2013 with Apache CXF 2.7.7.

Mitigation

Only recent versions of Apache CXF are community-supported. The affected 3.4.x and 3.5.x lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache CXF release line (3.6.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.