Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cxf:cxf-rt-ws-transfer | maven | = 4.2.0 | 4.2.1 |
| org.apache.cxf:cxf-rt-ws-transfer | maven | >= 4.1.0, < 4.1.6 | 4.1.6 |
| org.apache.cxf:cxf-rt-ws-transfer | maven | < 3.6.11 | 3.6.11 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the insecure configuration of XML parsers within the Apache CXF WS-Transfer module. Specifically, the constructors of XSDResourceTypeIdentifier, XSDResourceValidator, and XSLTResourceTransformer were identified as vulnerable. These constructors were creating instances of SchemaFactory and TransformerFactory without enabling secure processing features. This oversight would allow an attacker to supply a specially crafted XML document containing external entity references, leading to an XML External Entity (XXE) injection attack. The patch addresses this by explicitly setting XMLConstants.FEATURE_SECURE_PROCESSING to true and disabling access to external DTDs and schemas/stylesheets on the factory instances. This prevents the parser from resolving external entities, thus mitigating the XXE vulnerability.
