CVE-2025-48913: Apache CXF JMS Configuration Vulnerability Leading to Potential RCE
Summary
CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE. Affects org.apache.cxf:cxf-rt-transports-jms across 3 version ranges.
< 3.6.8
>= 4.0.0, < 4.0.9
>= 4.1.0, < 4.1.3
Fixed in 3.6.8, 4.0.9 or 4.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source services framework that helps in building and developing web services. It supports various protocols, including SOAP and REST, and is widely used for creating robust and scalable web applications. The package 'org.apache.cxf:cxf-rt-transports-jms' specifically handles the JMS (Java Message Service) transport, allowing applications to communicate via messaging. However, this package has a vulnerability that can be exploited if untrusted users are allowed to configure JMS settings.
Vulnerability Detail
The vulnerability arises from the ability of untrusted users to configure JMS for Apache CXF, which previously allowed the use of RMI or LDAP URLs. This could potentially lead to remote code execution (RCE) capabilities, as malicious users could exploit these protocols to execute arbitrary code on the server. The issue has been identified and addressed by restricting the interface to reject these dangerous protocols, thus mitigating the risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.6.83.6.8 -
>= 4.0.0, < 4.0.94.0.9 -
>= 4.1.0, < 4.1.34.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately feasible, ensure that untrusted users do not have access to configure JMS settings. This can be done by implementing strict access controls and monitoring configurations.
Conclusion
The vulnerability CVE-2025-48913 in Apache CXF's JMS configuration poses a significant risk if untrusted users are allowed to configure settings. It is crucial to upgrade to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for org.apache.cxf:cxf-rt-transports-jms →
FAQ
CVE-2025-48913 is a vulnerability in the Apache CXF JMS configuration that could allow untrusted users to execute arbitrary code.
Versions prior to 3.6.8, 4.0.9, and 4.1.3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application's pom.xml at Vulert Scanner without any signup.
Implement strict access controls to prevent untrusted users from configuring JMS settings as a temporary workaround.
If exploited, this vulnerability could lead to remote code execution, allowing attackers to run arbitrary code on the server.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-rt-transports-jms.
