CVE-2026-65432 Overview
CVE-2026-65432 is an XML External Entity (XXE) vulnerability in Apache CXF. The framework parses top-level WSDL documents through a hardened StaxUtils path that disables DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from the top-level WSDL is delegated to WSDL4J, which does not disable DOCTYPE declarations or external entities. The hardening applied to the parent document does not propagate to imported documents. Attackers who control or influence an imported WSDL/XSD can inject external entity references to read local files or trigger server-side requests. The issue is classified under CWE-611: Improper Restriction of XML External Entity Reference.
Critical Impact
Imported WSDL and XSD documents processed by Apache CXF can be abused for XXE, enabling file disclosure and server-side request forgery against services that load untrusted or attacker-influenced schemas.
Affected Products
- Apache CXF versions prior to 3.6.12
- Apache CXF 4.1.x versions prior to 4.1.8
- Apache CXF 4.2.x versions prior to 4.2.3
Discovery Timeline
- 2026-08-06 - CVE-2026-65432 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-65432
Vulnerability Analysis
Apache CXF applies XML hardening only at the top-level WSDL parse. The StaxUtils code path constructs an XMLInputFactory with DTD support and external entity resolution disabled. This protects the outer document from XXE. When the parser encounters a <wsdl:import> or <xsd:import> element, control transfers to WSDL4J for resolving the referenced document. WSDL4J parses the imported document through a DOM-based flow that leaves DOCTYPE processing and external entity resolution enabled by default. An attacker who can supply or influence an imported document can embed a DOCTYPE with an external entity, and the parser will resolve it. Successful exploitation leads to local file disclosure through file:// entities or outbound requests through http:// entities, resulting in server-side request forgery against internal systems.
Root Cause
The root cause is an inconsistent XML parser configuration across the WSDL processing pipeline. Hardening on the primary StaxUtils reader is not mirrored on the WSDL4J-based import resolver. The two parsers apply different security defaults for the same input class, breaking the assumption that a hardened entry point protects the entire document tree.
Attack Vector
Exploitation requires an Apache CXF endpoint or client that loads a WSDL referencing an attacker-controlled or attacker-modifiable imported document. The imported WSDL or XSD contains a DOCTYPE with an external entity declaration. When CXF resolves the import through WSDL4J, the entity is dereferenced and its contents are incorporated into parsing. Refer to the Apache Security Mailing List Thread for technical details on the affected code paths.
Detection Methods for CVE-2026-65432
Indicators of Compromise
- Outbound network connections from Apache CXF JVM processes to unexpected hosts during WSDL or XSD loading.
- WSDL or XSD files on disk or in transit containing <!DOCTYPE> declarations with SYSTEM external entity references.
- Application logs showing WSDL4J resolving imports from unexpected URIs or file paths.
- Java stack traces referencing com.ibm.wsdl or javax.wsdl.xml.WSDLReader immediately preceding I/O errors.
Detection Strategies
- Inventory running services for Apache CXF versions using dependency scanning and flag anything below 3.6.12, 4.1.8, or 4.2.3.
- Inspect WSDL and XSD assets consumed by CXF services for DOCTYPE declarations, which are not legitimate in WSDL/XSD content.
- Enable process-level network telemetry on JVMs hosting SOAP services and baseline expected import destinations.
Monitoring Recommendations
- Alert on JVM processes making DNS or HTTP requests to hosts not present in the approved WSDL import allowlist.
- Monitor for file reads by CXF JVM processes touching sensitive paths such as /etc/passwd, /proc/self/environ, or cloud metadata endpoints (169.254.169.254).
- Forward Apache CXF and WSDL4J parser logs to a central SIEM for correlation across services.
How to Mitigate CVE-2026-65432
Immediate Actions Required
- Upgrade Apache CXF to 4.2.3, 4.1.8, or 3.6.12 depending on your current branch.
- Audit deployed services for WSDL imports referencing external or untrusted URIs and remove or pin them to trusted local copies.
- Restrict egress from application servers hosting CXF so that unexpected outbound HTTP and DNS traffic is blocked at the network layer.
Patch Information
The Apache CXF project has released fixed versions 4.2.3, 4.1.8, and 3.6.12. These releases align the WSDL4J import path with the hardened StaxUtils configuration so that DTDs and external entities are disabled consistently across parent and imported documents. See the Apache Security Mailing List Thread for the vendor announcement.
Workarounds
- Where upgrading is not immediately possible, host all WSDL and XSD imports on internal infrastructure and validate their integrity before deployment.
- Configure network policy to deny outbound connections from CXF service hosts to any destination outside the approved import allowlist.
- Disable dynamic WSDL loading from remote URLs and rely on packaged, locally shipped schema artifacts.
# Maven dependency example enforcing a fixed Apache CXF version
# Update pom.xml to require a patched release, then rebuild and redeploy
mvn versions:set-property -Dproperty=cxf.version -DnewVersion=4.2.3
mvn clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
