CVE-2026-49875

CriticalCVSS 9.8/10Last modified Oct 29, 2026

Description

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
Apache Software FoundationApache CXF>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12
Red HatRed Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16—
Red HatRed Hat Build of Apache Camel 4.18 for Quarkus 3.33—
Red HatRed Hat build of Apache Camel 4 for Quarkus 3—
Red HatRed Hat Fuse 7—
Red HatRed Hat JBoss Enterprise Application Platform 7—
Red HatRed Hat JBoss Enterprise Application Platform 8—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat JBoss Web Server 5—
Red HatRed Hat Single Sign-On 7—

References

Timeline

Published
Jun 12, 2026
Last modified
Oct 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-498766.5Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidatedCVE-2026-498778.1Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* patCVE-2026-498787.2In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This coulCVE-2026-498798.8In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execuCVE-2026-49885.9A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCVE-2026-498807.8In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local eCVE-2026-498817.8In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could leCVE-2026-498828.8In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote codeCVE-2026-498835.5In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permissioCVE-2026-498847.8In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esCVE-2026-498857.8In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation CVE-2026-498877.8In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass.