CVE-2026-65432

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12

Description While the software uses a hardened path to disable XML DTDs and external entities for top-level WSDL files, any <wsdl:import> or <xsd:import> references are processed by WSDL4J. Because WSDL4J does not disable DOCTYPE declarations or external entities, imported WSDL/XSD content is susceptible to XML External Entity (XXE) attacks, where an attacker can use external entities to interfere with the application's processing of XML data.

Recommendations Upgrade to version 4.2.3. Upgrade to version 4.1.8. Upgrade to version 3.6.12.