CVE-2026-50632 PUBLISHED

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Assigner: apache
Reserved: 05.06.2026 Published: 12.06.2026 Updated: 12.06.2026

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Product Status

Vendor Apache Software Foundation
Product Apache CXF
Versions Default: unaffected
  • affected from 4.2.0 to 4.2.2 (excl.)
  • affected from 0 to 4.1.7 (excl.)

Credits

  • Venkatraman Kumar (r3dw0lfsec), Securin finder

References

Problem Types

  • CWE-20 Improper Input Validation CWE