PUBLISHED
2026-06-12 10:16
MODIFIED
2026-06-12 10:16
EPSS (Prob. Exploit)
0.89%
Top 40.7%
> DESCRIPTION
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-20: Improper Input Validation - The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
> RED HAT SECURITY ADVISORIES
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A...
> GITHUB SECURITY ADVISORY
GHSA-qp3f-rvj8-46c8
CRITICAL
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
AFFECTED PACKAGES:
MAVEN / org.apache.cxf:cxf-integration-jca
< 4.1.7
Fixed in: 4.1.7
MAVEN / org.apache.cxf:cxf-integration-jca
>= 4.2.0, < 4.2.2
Fixed in: 4.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
AFFECTED PACKAGES:
Unknown / Unknown
48 versions affected
ALIASES:
GHSA-qp3f-rvj8-46c8
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/06/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-20: Improper Input Validation - The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process...
Total des modifications: 1
Dernière mise à jour: 4 months ago