CVE-2026-49875: Apache CXF cxf-core XML External Entity Reference Vulnerability
Summary
CVE-2026-49875: Apache CXF has Improper Restriction of XML External Entity Reference. Affects org.apache.cxf:cxf-core across 2 version ranges.
< 4.1.7
>= 4.2.0, < 4.2.2
Fixed in 4.1.7 or 4.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source services framework that helps in the development of web services. It provides a robust and flexible architecture for building and deploying web services, supporting various protocols and data formats. The cxf-core package is central to its functionality, enabling developers to create and manage web service endpoints. However, a critical vulnerability has been identified in this package, which can lead to serious security risks if not addressed promptly.
Vulnerability Detail
The vulnerability in Apache CXF arises from the improper restriction of XML External Entity (XXE) references in the EndpointReferenceUtils and W3CMultiSchemaFactory classes. These classes create a SAXParserFactory without the necessary JAXP hardening configurations, allowing for out-of-band (OOB) external entity resolution. This can lead to sensitive data exposure, denial of service, and other malicious attacks. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical severity and potential impact on affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.74.1.7 -
>= 4.2.0, < 4.2.24.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing XML parsing configurations that disable external entity processing. This can be done by configuring the SAXParserFactory as follows:
System.setProperty("javax.xml.XMLParserFactory", "com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl");
System.setProperty("javax.xml.accessExternalDTD", "all");
System.setProperty("javax.xml.accessExternalSchema", "all");
Conclusion
The CVE-2026-49875 vulnerability in Apache CXF's cxf-core package poses a significant security risk due to improper handling of XML External Entity references. It is crucial for users to upgrade to the patched versions 4.2.2 or 4.1.7 to mitigate this risk. Implementing workarounds can provide temporary relief, but upgrading is the recommended solution.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
CVE-2026-49875 is a critical vulnerability in the Apache CXF cxf-core package that allows improper handling of XML External Entity references.
Exploitation of this vulnerability can lead to sensitive data exposure, denial of service, and other malicious attacks on the system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Implement XML parsing configurations to disable external entity processing as a temporary workaround until you can upgrade.
The CVSS score for CVE-2026-49875 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
