CVE-2026-50633

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

En bref

Sévérité: HIGH 8.1
EPSS: EPSS 0.89 % · centile 59 (2026-10-27)
État: PUBLISHED
Publiée: 2026-06-12
Mise à jour: 2026-08-07
Attribuée par: apache
Statut NVD: Modified

Description

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat-SADP
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Faiblesses (CWE)

Avis

GHSA-qp3f-rvj8-46c8 — Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Références européennes

ENISA EUVD · EUVD-2026-36401
GCVE · GCVE-0-2026-50633

Avis du CERT-FR

CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* < 4.1.7
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.2

Produits affectés

Produit	Versions
Apache Software Foundation · Apache CXF	affected 4.2.0 < 4.2.2 ; affected 4.0.0 < 4.1.7 ; affected 0 < 3.6.12

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD