CVE-2026-44930 PUBLISHED

Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

Assigner: apache
Reserved: 08.05.2026 Published: 22.05.2026 Updated: 22.05.2026

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.  Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Product Status

Vendor Apache Software Foundation
Product Apache CXF
Versions Default: unaffected
  • affected from 4.2.0 to 4.2.1 (excl.)
  • affected from 4.0.0 to 4.1.6 (excl.)
  • affected from 0 to 3.6.11 (excl.)

References

Problem Types

  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CWE