Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.9%
exploitation probability
0.9%top 45% of all CVEs
observed exploitation
nono source reports it
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache CXFReferences
https://access.redhat.com/errata/RHSA-2026:37390https://access.redhat.com/security/cve/CVE-2026-50633https://bugzilla.redhat.com/show_bug.cgi?id=2488307https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grfhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50633.jsonhttp://www.openwall.com/lists/oss-security/2026/06/11/10