Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Apache CXF has Improper Restriction of XML External Entity Reference

Fix availableCritical · CVSS 9.8EPSS 0.81%

Published Jun 12, 2026 · updated Oct 2, 2026

What to do

  1. Upgrade to a fixed version: org.apache.cxf:cxf-core 4.2.2, org.apache.cxf:cxf-core 4.1.7.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.cxf:cxf-core

Vulnerable versions
>= 4.2.0, < 4.2.2
Fixed in
4.2.2

Check your project: mvn dependency:tree -Dincludes=org.apache.cxf:cxf-core

Mavenorg.apache.cxf:cxf-core

Vulnerable versions
< 4.1.7
Fixed in
4.1.7

Check your project: mvn dependency:tree -Dincludes=org.apache.cxf:cxf-core

Sources

CWE-611 Improper Restriction of XML External Entity Reference

← All critical vulnerabilities