CVE-2026-49875

EUVD-2026-36394
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) 
external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
apachecxf
𝑥
< 4.1.7
apachecxf
4.2.0 ≤
𝑥
< 4.2.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o
http://www.openwall.com/lists/oss-security/2026/06/11/2
https://access.redhat.com/errata/RHSA-2026:36839
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/security/cve/CVE-2026-49875
https://bugzilla.redhat.com/show_bug.cgi?id=2488309
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49875.json