CVE-2026-44417 PUBLISHED

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Assigner: apache
Reserved: 06.05.2026 Published: 22.05.2026 Updated: 22.05.2026

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Product Status

Vendor Apache Software Foundation
Product Apache CXF
Versions Default: unaffected
  • affected from 4.2.0 to 4.2.1 (excl.)
  • affected from 4.0.0 to 4.1.6 (excl.)
  • affected from 0 to 3.6.11 (excl.)

Credits

  • Github / twitter - https://github.com/exploitintel / @exploit_intel finder

References

Problem Types

  • CWE-20 Improper Input Validation CWE