Apache CXF Patches LDAP Injection, XXE, and Incomplete-Fix RCE Flaws

The Apache Software Foundation released security updates for Apache CXF to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include CVE-2026-44930, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an XXE flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible remote code execution condition tied to an incomplete fix for an older JMS-related bug.

Affected releases include 4.2.0, 4.0.0 through 4.1.5, and older branches before 3.6.11. Apache published patched versions 4.2.1, 4.1.6, and 3.6.11, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.