CVE-2026-44930

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44930
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44930.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44930
Aliases
Downstream
Published
2026-05-22T12:16:47Z
Modified
2026-08-12T03:51:47Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
Details

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.  Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-90"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44930.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.2.0"
                },
                {
                    "fixed": "4.2.1"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.1.6"
                },
                {
                    "fixed": "3.6.11"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f6c40d171680d29516d62928d0bfc47873c84f0
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
62c2a2e056320b737d7517b511b5073d2eb70394
Introduced
04ccbfd709eef8f4af53d6237514fbe9db7ea81f
Last Affected
04ccbfd709eef8f4af53d6237514fbe9db7ea81f
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:cxf:4.2.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.11"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.1.6"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

4.*
4.2.0
cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.6.0
cxf-3.6.1
cxf-3.6.10
cxf-3.6.2
cxf-3.6.3
cxf-3.6.4
cxf-3.6.5
cxf-3.6.6
cxf-3.6.7
cxf-3.6.8
cxf-3.6.9
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4
cxf-4.1.0
cxf-4.1.1
cxf-4.1.2
cxf-4.1.3
cxf-4.1.4
cxf-4.1.5
cxf-4.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44930.json"