{
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
      },
      "title": "XXE via WSDL/XSD import parsing",
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-611 Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "cweId": "CWE-611",
              "type": "CWE"
            }
          ]
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "affected": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache CXF",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.cxf:cxf-rt-wsdl",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0",
              "lessThan": "4.2.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.1.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.6.12",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ],
      "descriptions": [
        {
          "value": "Apache CXF reads a top-level WSDL through its hardened StaxUtils\u00a0path, which disables XML DTDs and external entities. However, any <wsdl:import>\u00a0or <xsd:import>\u00a0referenced from that top-level WSDL is handed off to WSDL4J, which does not\u00a0disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks.\u00a0Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.",
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<span style=\"background-color: rgb(253, 253, 252);\">Apache CXF reads a top-level WSDL through its hardened </span><code>StaxUtils</code><span style=\"background-color: rgb(253, 253, 252);\">&nbsp;path, which disables XML DTDs and external entities. However, any </span><code>&lt;wsdl:import&gt;</code><span style=\"background-color: rgb(253, 253, 252);\">&nbsp;or </span><code>&lt;xsd:import&gt;</code><span style=\"background-color: rgb(253, 253, 252);\">&nbsp;referenced from that top-level WSDL is handed off to WSDL4J, which does </span><strong>not</strong><span style=\"background-color: rgb(253, 253, 252);\">&nbsp;disable </span><span style=\"background-color: rgb(253, 253, 252);\">DOCTYPE </span><span style=\"background-color: rgb(253, 253, 252);\">declarations </span><span style=\"background-color: rgb(253, 253, 252);\">or </span><span style=\"background-color: rgb(253, 253, 252);\">external </span><span style=\"background-color: rgb(253, 253, 252);\">entities. </span><span style=\"background-color: rgb(253, 253, 252);\">As </span><span style=\"background-color: rgb(253, 253, 252);\">a </span><span style=\"background-color: rgb(253, 253, 252);\">result, </span><span style=\"background-color: rgb(253, 253, 252);\">the </span><span style=\"background-color: rgb(253, 253, 252);\">protections </span><span style=\"background-color: rgb(253, 253, 252);\">applied </span><span style=\"background-color: rgb(253, 253, 252);\">to </span><span style=\"background-color: rgb(253, 253, 252);\">the </span><span style=\"background-color: rgb(253, 253, 252);\">top-level </span><span style=\"background-color: rgb(253, 253, 252);\">document </span><span style=\"background-color: rgb(253, 253, 252);\">do </span><span style=\"background-color: rgb(253, 253, 252);\">not </span><span style=\"background-color: rgb(253, 253, 252);\">extend </span><span style=\"background-color: rgb(253, 253, 252);\">to </span><span style=\"background-color: rgb(253, 253, 252);\">imported </span><span style=\"background-color: rgb(253, 253, 252);\">documents, </span><span style=\"background-color: rgb(253, 253, 252);\">leaving </span><span style=\"background-color: rgb(253, 253, 252);\">imported </span><span style=\"background-color: rgb(253, 253, 252);\">WSDL/XSD </span><span style=\"background-color: rgb(253, 253, 252);\">content </span><span style=\"background-color: rgb(253, 253, 252);\">vulnerable </span><span style=\"background-color: rgb(253, 253, 252);\">to </span><span style=\"background-color: rgb(253, 253, 252);\">XML </span><span style=\"background-color: rgb(253, 253, 252);\">External </span><span style=\"background-color: rgb(253, 253, 252);\">Entity </span><span style=\"background-color: rgb(253, 253, 252);\">(XXE) </span><span style=\"background-color: rgb(253, 253, 252);\">attacks.&nbsp;</span>Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue."
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3",
          "tags": [
            "vendor-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "type": "Textual description of severity",
            "content": {
              "text": "important"
            }
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by n0mi1k",
          "type": "finder"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "cveId": "CVE-2026-65432",
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "serial": 1,
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}