CVE-2026-65432

published 2026-08-06

CVE-2026-65432: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that…

Priority P3 46 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
apache	cxf	< 3.6.12	3.6.12
apache	cxf	—	—
apache	cxf	>= 4.0.0 < 4.1.8	4.1.8
apache	cxf	>= 4.2.0 < 4.2.3	4.2.3
apache_software_foundation	apache_cxf	< 3.6.12	3.6.12
apache_software_foundation	apache_cxf	>= 4.0.0 < 4.1.8	4.1.8
apache_software_foundation	apache_cxf	>= 4.2.0 < 4.2.3	4.2.3
jboss-eap-7	eap74-els-openjdk11-openshift-rhel8	—	—
jboss-eap-7	eap74-els-openjdk17-openshift-rhel8	—	—
jboss-eap-7	eap74-els-openjdk8-openshift-rhel8	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vendor_redhat 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611