CVE-2026-49875

EUVD-2026-36394
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) 
external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachecxf
4.2.0 ≤
𝑥
< 4.2.2
CNA
apachecxf
𝑥
< 4.1.7
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o
http://www.openwall.com/lists/oss-security/2026/06/11/2