CVE-2026-49875 is a critical (CVSS 9.8) XML external entity flaw in Apache CXF. Two classes build an XML parser without hardening, which enables out-of-band external entity resolution. Upgrade to CXF 4.2.2, 4.1.7 or 3.6.12, the versions the Apache project says fix it.
What's affected
- Product: Apache CXF, the Java web services framework.
- Affected classes:
EndpointReferenceUtilsandW3CMultiSchemaFactory. - Fixed: 4.2.2, 4.1.7 or 3.6.12. The CVE record does not list the affected range, so treat any older release on those branches as affected until the advisory says otherwise.
- Weakness: CWE-611, improper restriction of XML external entity reference.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Published 12 June 2026. Not marked as exploited in CISA KEV.
- Red Hat has published errata, so check your distribution too.
How to check if you're exposed
List CXF modules in your build.
# Maven
mvn dependency:tree -Dincludes=org.apache.cxf
# Gradle
gradle dependencies --configuration runtimeClasspath | grep -i 'org.apache.cxf'
For deployed applications, look inside the packaged files.
find / -name 'cxf-*.jar' 2>/dev/null
unzip -l app.war | grep -i cxf
Compare the version in the file name with the fixed releases above. Remember that some products embed CXF, so also check vendor advisories for software you did not write.
What to do now
- Upgrade CXF to 4.2.2, 4.1.7 or 3.6.12, depending on your branch.
- Rebuild and redeploy every service. Repackage fat jars and wars that bundle CXF.
- Check which of your services accept XML or schemas from outside your trust boundary.
- Block unnecessary outbound connections from application servers. Out-of-band entity resolution needs the server to call out, so egress filtering limits the impact.
- Add your own XML parsing code to a review: it should disable external entities and DTDs unless they are truly needed.
Why it matters
XML lets a document refer to outside resources through entities. A parser should not follow those references for untrusted input. When a parser is created without turning that off, a document can make the server read local files or contact other systems. The record says the two classes created a SAXParserFactory without the needed JAXP hardening, which allows out-of-band resolution.
This is the standard XXE problem, CWE-611, and it keeps appearing because the default settings of many XML parsers are permissive. Library authors can fix it in one place, which is why upgrading matters more than patching your own code here.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Do I need a CXF endpoint exposed to be affected?
The record names two utility classes, so the exposure depends on how your application uses them. Upgrade rather than trying to prove a negative.
Sources
- Apache announcement thread (named in the CVE record; its page did not render for me, so details come from the record)
- oss-security post
- Red Hat CVE page
- Safeguard Gold entry
Last reviewed: 19 October 2026.
