CVE-2026-49875: Apache CXF XXE Vulnerability

CVE-2026-49875 Overview

CVE-2026-49875 is an XML External Entity (XXE) vulnerability in Apache CXF, a widely deployed open-source services framework for building web services in Java. The EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without applying the JAXP hardening configurations required to disable external entity resolution. Attackers can submit crafted XML payloads that trigger out-of-band (OOB) external entity resolution, leading to data exfiltration, server-side request forgery, and potential service compromise. The Apache CXF project has released fixed versions 4.2.2 and 4.1.7.

Critical Impact
Remote, unauthenticated attackers can exploit XXE in Apache CXF to exfiltrate sensitive data, perform SSRF against internal systems, and disrupt service availability.

Affected Products

Apache CXF versions prior to 4.2.2 (4.2.x branch)
Apache CXF versions prior to 4.1.7 (4.1.x branch)
Applications and services embedding vulnerable Apache CXF releases for SOAP and REST endpoints

Discovery Timeline

2026-06-12 - CVE-2026-49875 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49875

Vulnerability Analysis

Apache CXF processes XML documents using JAXP (Java API for XML Processing) parsers obtained from SAXParserFactory. The vulnerable classes EndpointReferenceUtils and W3CMultiSchemaFactory instantiate the factory without setting the security features that disable Document Type Definition (DTD) processing and external entity resolution. As a result, an attacker-supplied XML document containing an external entity declaration causes the parser to fetch remote resources during processing. The flaw maps to [CWE-611: Improper Restriction of XML External Entity Reference].

Root Cause

The root cause is missing JAXP hardening on parser construction. Specifically, the affected code does not call setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) or disable external-general-entities and external-parameter-entities on the SAXParserFactory instance. Without these features set, the underlying parser resolves any SYSTEM or PUBLIC identifiers declared in the inbound XML.

Attack Vector

An unauthenticated remote attacker sends a SOAP request, WS-Addressing endpoint reference, or schema document containing a malicious <!DOCTYPE> declaration with an external entity. When Apache CXF parses the document, the parser issues an outbound request to the attacker-controlled URL embedded in the entity. The attacker can read local files reachable to the JVM, scan internal network services through SSRF, or trigger denial of service via entity expansion. Because the parser is invoked during normal endpoint processing, no authentication is required to reach the vulnerable code path.

No verified public proof-of-concept code is available at this time. See the Apache Security Mailing List Thread and the OpenWall OSS Security Post for technical details.

Detection Methods for CVE-2026-49875

Indicators of Compromise

Outbound DNS or HTTP requests from application servers to unfamiliar external domains immediately after receiving SOAP or XML requests
Inbound XML payloads containing <!DOCTYPE> declarations, <!ENTITY> definitions, or SYSTEM/PUBLIC identifiers referencing external URLs
Unexpected read access to local files such as /etc/passwd, application configuration files, or AWS metadata endpoints from the CXF process

Detection Strategies

Inspect HTTP request bodies arriving at CXF endpoints for DOCTYPE and ENTITY keywords and alert on matches
Correlate inbound XML traffic with subsequent outbound connections from the Java process to identify OOB exfiltration
Audit deployed Apache CXF JAR versions across the environment and flag any release prior to 4.2.2 or 4.1.7

Monitoring Recommendations

Enable DNS query logging on application servers and alert on lookups to attacker-style domains used for OOB exfiltration (for example, Burp Collaborator and interact.sh patterns)
Monitor egress firewall logs for unexpected outbound traffic originating from JVMs hosting CXF services
Capture and review application access logs for repeated XML parsing errors that may indicate exploitation attempts

How to Mitigate CVE-2026-49875

Immediate Actions Required

Upgrade Apache CXF to version 4.2.2 or 4.1.7 on all affected services
Inventory dependent applications using build tooling such as mvn dependency:tree or gradle dependencies to locate transitive CXF usage
Restrict outbound network traffic from application servers to block OOB data exfiltration channels while patches are deployed

Patch Information

The Apache CXF project addressed the vulnerability by adding JAXP hardening when constructing SAXParserFactory instances in EndpointReferenceUtils and W3CMultiSchemaFactory. Upgrade to Apache CXF 4.2.2 (for the 4.2.x branch) or 4.1.7 (for the 4.1.x branch). Refer to the Apache Security Mailing List Thread for official guidance.

Workarounds

Place a web application firewall in front of CXF endpoints to strip or reject XML payloads containing DOCTYPE declarations
Enforce strict egress filtering so that JVMs hosting CXF cannot initiate outbound connections to arbitrary hosts
Where source modification is feasible, programmatically disable DTDs and external entities on any SAXParserFactory, DocumentBuilderFactory, and SchemaFactory instances used by the application

bash

# Configuration example: verify installed Apache CXF version and upgrade via Maven
mvn dependency:tree | grep -i cxf

# Update pom.xml to a fixed release
# <dependency>
#   <groupId>org.apache.cxf</groupId>
#   <artifactId>cxf-core</artifactId>
#   <version>4.2.2</version>
# </dependency>

mvn -U clean package