Ten Apache CXF flaws patched in 3.6.13, 4.1.9, and 4.2.4

Apache patched ten CXF flaws on 9 October 2026 in 3.6.13, 4.1.9, and 4.2.4; four are important and none report exploitation.

On 9 October 2026, oss-security published ten Apache CXF advisories, all fixed in 3.6.13, 4.1.9, and 4.2.4, covering releases before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4; none report exploitation. Four are important: CVE-2026-79650, an OIDC relying-party open redirect after successful login; CVE-2026-97468, which cached validated STS tokens under a non-cryptographic 32-bit hash and treated a cache hit as prior validation; CVE-2026-97791, in which shared STSTokenValidator state could let an unauthenticated attacker have an untrusted SAML assertion accepted; and CVE-2026-107938, missing TLS hostname verification in the Netty HTTP client on HTTP/1.1 and HTTP/2 even when disableCNCheck remains false. Two are moderate: CVE-2026-78384, unbounded DEFLATE decompression in JOSE/JWE and SAML processing where about a kilobyte can expand to gigabytes, and CVE-2026-100227, XML signature wrapping because JAX-RS XML Security interceptors did not ensure application XML was signature-covered. Four are low: CVE-2026-71575 (inoperative OIDC max_age freshness check), CVE-2026-73179 (non-atomic reuse of JPA OAuth2 authorization codes), CVE-2026-107937 (multipart/MTOM attachment header size and count limits bypassed; defaults 300 characters and 500 headers), and CVE-2026-108039 (StaxUtils with no default cap on XML elements or characters). The ten posts do not conflict on affected versions, ratings, or the lack of reported exploitation.