{"schema_version": "1.6.1", "id": "CVE-2026-65432", "summary": "XXE via WSDL/XSD import parsing", "details": "Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "4.2.0"}, {"fixed": "4.2.3"}]}, {"type": "SEMVER", "events": [{"introduced": "4.0.0"}, {"fixed": "4.1.8"}]}, {"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "3.6.12"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/5qs207krzg51jl3zs3cvnl5lt9njp8c3"}]}