XML External Entity Vulnerability in Apache CXF Affecting Imported WSDL Documents

CVE-2026-65432

What is CVE-2026-65432?

Apache CXF exposes imported WSDL documents to XML External Entity (XXE) vulnerabilities due to inadequate protection mechanisms. While the framework's hardened StaxUtils path disables XML DTDs and external entities for the top-level WSDL documents, it fails to extend these restrictions to imported WSDL/XSD files processed by WSDL4J. Consequently, this oversight can be exploited, allowing attackers to manipulate the responses from the imported documents. Users are strongly advised to upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12 to mitigate this security risk.

References