org.apache.cxf:cxf-rt-ws-security vulnerabilities
CVEs whose affected-version data names the org.apache.cxf:cxf-rt-ws-security package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-97791High· 7.5In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's r…
▾ TwilightApache Software Foundation · org.apache.cxf:cxf-rt-ws-securityEPSS 0.30%via NVD
CVE-2026-97468Critical· 9.1Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented to…
Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented to…
▾ MidnightApache Software Foundation · org.apache.cxf:cxf-rt-ws-securityEPSS 0.22%via NVD