GitHub Advisoryadvisory · Maven

GHSA-93g8-qqv3-mrx8 Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

CRITICAL Published 2026-06-12 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-50632
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-transports-jms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-502
Reviewed
2026-08-20

Affected packages

• Maven org.apache.cxf:cxf-rt-transports-jms: >= 4.2.0, < 4.2.2 → fixed in 4.2.2 • Maven org.apache.cxf:cxf-rt-transports-jms: >= 4.1.0, < 4.1.7 → fixed in 4.1.7 • Maven org.apache.cxf:cxf-rt-transports-jms: < 3.6.12 → fixed in 3.6.12

Description

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-50632 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References