GitHub Advisoryadvisory · Maven

GHSA-2hvc-5c6v-f533 Apache CXF: Untrusted JMS configuration can lead to RCE

HIGH Published 2026-05-26 Modified 2026-06-29 Official page ↗
Aliases
CVE-2026-44417
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-transports-jms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2026-06-29

Affected packages

• Maven org.apache.cxf:cxf-rt-transports-jms: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • Maven org.apache.cxf:cxf-rt-transports-jms: >= 4.1.0, < 4.1.6 → fixed in 4.1.6 • Maven org.apache.cxf:cxf-rt-transports-jms: < 3.6.11 → fixed in 3.6.11

Description

The fix for CVE-2025-48913: `Apache CXF: Untrusted JMS configuration can lead to RCE` was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Related

Alias · CVE (1)

  • CVE-2026-44417 The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References