CVE-2012-5575: Inadequate Encryption Strength in Apache CXF
Summary
CVE-2012-5575: Inadequate Encryption Strength in Apache CXF. Affects org.apache.cxf:cxf-rt-transports-http across 3 version ranges.
>= 2.5.0, < 2.5.10
>= 2.6.0, < 2.6.7
>= 2.7.0, < 2.7.4
Fixed in 2.5.10, 2.6.7 or 2.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that provides a comprehensive set of tools for building SOAP and RESTful services. It is widely used in Java-based applications to enable communication between different systems. The 'org.apache.cxf:cxf-rt-transports-http' package is a part of Apache CXF and is responsible for handling HTTP transport for CXF services.
Vulnerability Detail
The vulnerability, known as 'XML Encryption backwards compatibility attack' (CVE-2012-5575), affects Apache CXF versions 2.5.x, 2.6.x, and 2.7.x. It arises from a failure to verify the cryptographic algorithm specified in the WS-SecurityPolicy AlgorithmSuite definition before decrypting. This oversight allows remote attackers to force the use of weaker cryptographic algorithms than intended, making it easier to decrypt communications. The impact of this vulnerability is the potential compromise of sensitive information transmitted over insecure channels.
How To Fix
Latest published version: 4.2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.5.0, < 2.5.102.5.10 -
>= 2.6.0, < 2.6.72.6.7 -
>= 2.7.0, < 2.7.42.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Apache CXF.
Conclusion
The 'Inadequate Encryption Strength in Apache CXF' vulnerability (CVE-2012-5575) affects Apache CXF versions 2.5.x, 2.6.x, and 2.7.x. It allows attackers to exploit weaker cryptographic algorithms, potentially compromising the confidentiality of transmitted data. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Apache CXF. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-rt-transports-http →
FAQ
Apache CXF is an open-source web services framework used for building SOAP and RESTful services in Java-based applications.
The 'org.apache.cxf:cxf-rt-transports-http' package is a part of Apache CXF and handles HTTP transport for CXF services.
The vulnerability allows attackers to force the use of weaker cryptographic algorithms, potentially compromising the confidentiality of sensitive information transmitted over insecure channels.
To fix this vulnerability, upgrade to Apache CXF versions 2.5.10, 2.6.7, or 2.7.4, depending on the currently used version.
No, there is no known workaround for this vulnerability. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-rt-transports-http.
