CVE-2026-44618: Apache CXF XXE Vulnerability

CVE-2026-44618 Overview

CVE-2026-44618 is an XML External Entity (XXE) vulnerability in the WS-Transfer module of Apache CXF. The flaw stems from an insecure XML parser configuration that fails to disable external entity resolution. Attackers can submit crafted XML payloads to a vulnerable endpoint and trigger out-of-band entity expansion. This can result in disclosure of local file contents or other information accessible to the service process. The issue is tracked under CWE-611 (Improper Restriction of XML External Entity Reference). Apache has released fixed builds in versions 4.2.1, 4.1.6, and 3.6.11.

Critical Impact

A remote, unauthenticated attacker can send crafted XML to the WS-Transfer endpoint to read sensitive data exposed through XML external entity processing.

Affected Products

• Apache CXF versions prior to 4.2.1 in the 4.2.x branch
• Apache CXF versions prior to 4.1.6 in the 4.1.x branch
• Apache CXF versions prior to 3.6.11 in the 3.6.x branch

Discovery Timeline

• 2026-05-22 - CVE-2026-44618 published to NVD
• 2026-05-22 - Apache Software Foundation publishes the security mailing list advisory
• 2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-44618

Vulnerability Analysis

Apache CXF is a services framework that implements JAX-WS and JAX-RS APIs and supports SOAP, XML/HTTP, and WS-* specifications. The WS-Transfer module implements the WS-Transfer specification, which defines a SOAP-based protocol for resource creation, retrieval, update, and deletion. The module processes XML payloads received over the network as part of its standard operation.

The vulnerability arises because the underlying XML parser used by the WS-Transfer module is instantiated without disabling external entity processing. When the parser encounters a DOCTYPE declaration containing an external entity reference, it resolves the reference at parse time. An attacker who can reach a CXF service exposing WS-Transfer operations can craft a SOAP body that includes such an entity declaration.

Successful exploitation does not require authentication or user interaction. The impact is limited to disclosure of data the service process can read, such as local files referenced through file:// URIs or content fetched through outbound http:// requests. There is no direct path to integrity loss or denial of service from this defect alone.

Root Cause

The root cause is the failure to set secure-processing features on the XML parser, specifically the absence of FEATURE_SECURE_PROCESSING and the lack of disabling external-general-entities and external-parameter-entities on the parser factory. This is a classic [CWE-611] pattern in Java services that consume SOAP traffic.

Attack Vector

The attack vector is network-based. An attacker sends a SOAP request to a WS-Transfer endpoint with an XML document containing a malicious DOCTYPE and entity reference. When the CXF service parses the request, the entity resolves and the referenced content is incorporated into the parsed document. The attacker observes the result through service responses, error messages, or out-of-band channels such as DNS or HTTP callbacks under attacker control.

No verified proof-of-concept code is publicly available at this time. Refer to the Apache security mailing list thread and the OpenWall OSS Security discussion for further technical context.

Detection Methods for CVE-2026-44618

Indicators of Compromise

• Inbound SOAP or XML requests to CXF WS-Transfer endpoints containing <!DOCTYPE declarations or <!ENTITY references
• Outbound connections from the CXF JVM process to unexpected hosts, especially DNS lookups or HTTP requests to attacker-controlled domains immediately following inbound WS-Transfer traffic
• Application logs showing XML parsing of payloads that reference file://, http://, or ftp:// URIs in entity declarations

Detection Strategies

• Inspect HTTP request bodies destined for WS-Transfer service paths and flag any containing DOCTYPE or external entity syntax
• Correlate inbound SOAP traffic with subsequent outbound network activity from the application server within a short time window
• Review CXF and underlying JAXP parser logs for entity resolution events on production endpoints

Monitoring Recommendations

• Enable verbose logging on CXF interceptors handling inbound XML and forward to a central log platform
• Deploy egress filtering on application server subnets and alert on outbound traffic to non-allowlisted destinations
• Track the installed Apache CXF version across the estate and alert when versions below 3.6.11, 4.1.6, or 4.2.1 appear

How to Mitigate CVE-2026-44618

Immediate Actions Required

• Upgrade Apache CXF to 4.2.1, 4.1.6, or 3.6.11 depending on the deployed branch
• Inventory all internal and external services built on Apache CXF and confirm whether WS-Transfer is enabled
• Restrict network access to WS-Transfer endpoints to trusted clients while patching is in progress

Patch Information

Apache has released fixed versions that configure the XML parser to reject external entity references. Operators running the 4.2.x branch should upgrade to 4.2.1. Operators on 4.1.x should upgrade to 4.1.6, and operators on 3.6.x should upgrade to 3.6.11. See the Apache Security Mailing List Thread for the official advisory.

Workarounds

• Disable the WS-Transfer module if it is not required by the application
• Place a reverse proxy or web application firewall in front of CXF endpoints and block requests containing DOCTYPE declarations
• Apply egress network controls so the application server cannot resolve external URIs referenced in malicious entity payloads

# Configuration example: enforce secure XML processing at the JVM level
# Add to JAVA_OPTS for the application server hosting Apache CXF
-Djavax.xml.accessExternalDTD=""
-Djavax.xml.accessExternalSchema=""
-Djdk.xml.entityExpansionLimit=0