Vulnerabilities

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.

In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called.

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits.

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module.

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS.

Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that…

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions.

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication.

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap.

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization…

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.