GitHub Advisoryadvisory · Maven

GHSA-g4px-6qhm-hqjm Apache CXF: Untrusted JMS configuration can lead to RCE

MEDIUM Published 2025-08-08 Modified 2026-01-23 Official page ↗
Aliases
CVE-2025-48913
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-transports-jms
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-20
Reviewed
2025-08-08

Affected packages

• Maven org.apache.cxf:cxf-rt-transports-jms: < 3.6.8 → fixed in 3.6.8 • Maven org.apache.cxf:cxf-rt-transports-jms: >= 4.0.0, < 4.0.9 → fixed in 4.0.9 • Maven org.apache.cxf:cxf-rt-transports-jms: >= 4.1.0, < 4.1.3 → fixed in 4.1.3

Description

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Related

Alias · CVE (1)

  • CVE-2025-48913 If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References