CVE-2026-65432
Description
A flaw was found in Apache CXF. The framework's initial processing of a Web Services Description Language (WSDL) document disables XML DTDs (Document Type Definitions) and external entities. However, any WSDL or XML Schema Definition (XSD) documents imported by the top-level WSDL are processed by a different component, WSDL4J, which does not apply these same security protections. This oversight allows an attacker to exploit XML External Entity (XXE) vulnerabilities through imported WSDL/XSD content, potentially leading to information disclosure or denial of service.
Statement
Apache CXF is affected by an XML External Entity (XXE) vulnerability when processing imported WSDL/XSD content. The vulnerability exists because WSDL4J, which Apache CXF uses to parse WSDL imports, lacks restrictions on DTD declarations and external entity references. An attacker can exploit this to read arbitrary files or conduct denial of service attacks. Note that this requires the application to process untrusted WSDL/XSD imports and have the WSDL4J library on the classpath.
Mitigation
Update Apache CXF to a version that includes the fix. Disable DTD processing and external entity resolution in XML parsers. Avoid processing untrusted WSDL/XSD imports.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.6 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | None |
| Availability Impact | Low | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
