NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#apache-cxf

0 stories this week · 6 this month · 6 in 6 months · mostly security

Stories per day · 30 days

Relatedjava3 denial-of-service2 sts2 authentication1 authentication-bypass1 cve-2026-1002271 cve-2026-1079371 cve-2026-1079381 cve-2026-864631 cve-2026-974681 cve-2026-977911 fiql1 hash-collision1 hostname-verification1 jax-rs1 memory-exhaustion1 mitm1 mtom1

2 stories, newest first · one card per story

oss-security21d agohigh

CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

Apache CXF Netty HTTP client skipped TLS hostname verification, enabling potential man-in-the-middle attacks.

2 sources apache-cxf tls

3

oss-security21d ago

CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

Apache CXF cached validated STS tokens under a 32-bit hash, enabling authentication bypass.

9 sources apache-cxf authentication-bypass

3