{ "@id": "urn:uuid:3e94e030-2a3a-4c52-87b5-7507f70a844e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-07T00:44:00.065178+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2014-0035 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0035 is NOT present in Apache CXF 3.4.5. The vulnerability, where UsernameTokens in EncryptedSupportingTokens were transmitted in cleartext when EncryptBeforeSigning was enabled, was fixed in upstream Apache CXF via commit 6358dc0577 (CXF-5046) on 2013-05-30, years before this version was released. The fix ensures UsernameTokens are properly added to the encrypted tokens list and encry...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0035" }, "impact_statement": "not_affected \u2014 CVE-2014-0035 is NOT present in Apache CXF 3.4.5. The vulnerability, where UsernameTokens in EncryptedSupportingTokens were transmitted in cleartext when EncryptBeforeSigning was enabled, was fixed in upstream Apache CXF via commit 6358dc0577 (CXF-5046) on 2013-05-30, years before this version was released. The fix ensures UsernameTokens are properly added to the encrypted tokens list and encry..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2014-0109 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0109 describes a DoS vulnerability where sending a large request with Content-Type: text/html to a SOAP endpoint triggers unbounded memory consumption during error handling. The fix (commit 4fb48afde2, CXF-6173, December 2014) added XML element depth and count limits during SAAJ processing. This fix was already present in upstream Apache CXF 3.4.5 when TuxCare onboarded it. The target ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0109" }, "impact_statement": "not_affected \u2014 CVE-2014-0109 describes a DoS vulnerability where sending a large request with Content-Type: text/html to a SOAP endpoint triggers unbounded memory consumption during error handling. The fix (commit 4fb48afde2, CXF-6173, December 2014) added XML element depth and count limits during SAAJ processing. This fix was already present in upstream Apache CXF 3.4.5 when TuxCare onboarded it. The target ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2014-0110 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 Apache CXF version 3.4.5 is not affected by CVE-2014-0110. The vulnerability affected versions before 2.6.14 and 2.7.x before 2.7.11. The fix (size limit enforcement mechanism) was introduced in upstream Apache CXF 2.6.14/2.7.11 (2014) and is present in version 3.4.5. The defense mechanism exists but requires explicit configuration of ATTACHMENT_MAX_SIZE to activate protection against large SOA...", "vulnerability": { "name": "CVE-2014-0110" }, "impact_statement": "not_affected \u2014 Apache CXF version 3.4.5 is not affected by CVE-2014-0110. The vulnerability affected versions before 2.6.14 and 2.7.x before 2.7.11. The fix (size limit enforcement mechanism) was introduced in upstream Apache CXF 2.6.14/2.7.11 (2014) and is present in version 3.4.5. The defense mechanism exists but requires explicit configuration of ATTACHMENT_MAX_SIZE to activate protection against large SOA..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2016-6812 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2016-6812 is NOT present in Apache CXF 3.4.5-tuxcare.1. The vulnerability involved matrix parameters (`;param=value`) in request URLs being reflected into the HTML service list page without sanitization, creating an XSS risk. The fix was implemented by upstream Apache CXF developer Sergey Beryozkin in commit a23c615b68 (October 2016) and was already present in the Apache CXF 3.4.5 upstream ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6812" }, "impact_statement": "not_affected \u2014 CVE-2016-6812 is NOT present in Apache CXF 3.4.5-tuxcare.1. The vulnerability involved matrix parameters (`;param=value`) in request URLs being reflected into the HTML service list page without sanitization, creating an XSS risk. The fix was implemented by upstream Apache CXF developer Sergey Beryozkin in commit a23c615b68 (October 2016) and was already present in the Apache CXF 3.4.5 upstream ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2016-8739 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. CVE-2016-8739 is NOT present in Apache CXF 3.4.5. The vulnerability (XXE through entity expansion in Atom JAX-RS MessageBodyReaders) was fixed in the upstream release before TuxCare onboarded version 3.4.5. The target code uses the secure approach (CXF StaxUtils.createXMLStreamReader) instead of the vulnerable direct InputStream parsing with Abdera parser.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-8739" }, "impact_statement": "CVE-2016-8739 is NOT present in Apache CXF 3.4.5. The vulnerability (XXE through entity expansion in Atom JAX-RS MessageBodyReaders) was fixed in the upstream release before TuxCare onboarded version 3.4.5. The target code uses the secure approach (CXF StaxUtils.createXMLStreamReader) instead of the vulnerable direct InputStream parsing with Abdera parser.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2017-12624 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 The target Apache CXF 3.4.5 is not affected by CVE-2017-12624. The vulnerability (unbounded MIME attachment header parsing leading to DoS via memory exhaustion) was fixed in upstream commit 8bd915bfd7, which is present in the Apache CXF 3.4.5 release that TuxCare onboarded. The fix adds a configurable maximum header length (default 300 characters) that is enforced during attachment header parsi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12624" }, "impact_statement": "not_affected \u2014 The target Apache CXF 3.4.5 is not affected by CVE-2017-12624. The vulnerability (unbounded MIME attachment header parsing leading to DoS via memory exhaustion) was fixed in upstream commit 8bd915bfd7, which is present in the Apache CXF 3.4.5 release that TuxCare onboarded. The fix adds a configurable maximum header length (default 300 characters) that is enforced during attachment header parsi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2017-5653 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2017-5653 is not present in Apache CXF 3.4.5. The vulnerability, which allowed JAX-RS XML Security streaming clients to accept unsigned/unencrypted responses due to missing validation interceptor registration, was fixed by upstream commit fade9b81 (Sergey Beryozkin) before this version was released. The fix deleted the vulnerable ClientXmlSecInInterceptor class that had an empty override of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5653" }, "impact_statement": "not_affected \u2014 CVE-2017-5653 is not present in Apache CXF 3.4.5. The vulnerability, which allowed JAX-RS XML Security streaming clients to accept unsigned/unencrypted responses due to missing validation interceptor registration, was fixed by upstream commit fade9b81 (Sergey Beryozkin) before this version was released. The fix deleted the vulnerable ClientXmlSecInInterceptor class that had an empty override of..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2017-5656 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. CVE-2017-5656 is not present in the target Apache CXF 3.4.5. The vulnerability involved a flawed token caching mechanism where STSClient's DefaultSTSTokenCacher extracted token identifiers by blindly checking for generic attributes (wsu:Id, ID, AssertionID) without validating the token type, allowing attackers to craft tokens that collide with cached tokens of other users. The fix (commit 66c2c5b99e) was already present in the upstream Apache CXF 3.4.5 release that TuxCare onboarded. The target code validates token type and namespace before extracting identifiers, using type-specific extraction methods including SHA-256 hashing for binary tokens.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.1.0, < 3.1.11; < 3.0.13), NVD (>= 3.0.0, < 3.0.13; >= 3.1.0, < 3.1.11), cve.org (>= 3.1, < 3.1.11; < 3.0.13), Snyk (< 3.0.14; >= 3.1.0, < 3.1.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5656" }, "impact_statement": "CVE-2017-5656 is not present in the target Apache CXF 3.4.5. The vulnerability involved a flawed token caching mechanism where STSClient's DefaultSTSTokenCacher extracted token identifiers by blindly checking for generic attributes (wsu:Id, ID, AssertionID) without validating the token type, allowing attackers to craft tokens that collide with cached tokens of other users. The fix (commit 66c2c5b99e) was already present in the upstream Apache CXF 3.4.5 release that TuxCare onboarded. The target code validates token type and namespace before extracting identifiers, using type-specific extraction methods including SHA-256 hashing for binary tokens.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.1.0, < 3.1.11; < 3.0.13), NVD (>= 3.0.0, < 3.0.13; >= 3.1.0, < 3.1.11), cve.org (>= 3.1, < 3.1.11; < 3.0.13), Snyk (< 3.0.14; >= 3.1.0, < 3.1.11)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2022-46363 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2022-46363" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2022-46364 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2022-46364" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2025-23184 affects version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2025-23184" }, "action_statement": "Vulnerability CVE-2025-23184 affects version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2025-48795 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core. not_affected \u2014 Version 3.4.5 does not contain the vulnerable code path. The CVE-2025-48795 vulnerability exists in DelayedCachedOutputStreamCleaner class which was introduced in version 3.5.11 (September 2024). Version 3.4.5 predates this component and lacks the leak detection logging mechanism that causes the vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48795" }, "impact_statement": "not_affected \u2014 Version 3.4.5 does not contain the vulnerable code path. The CVE-2025-48795 vulnerability exists in DelayedCachedOutputStreamCleaner class which was introduced in version 3.5.11 (September 2024). Version 3.4.5 predates this component and lacks the leak detection logging mechanism that causes the vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2026-107937 affects version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-107937" }, "action_statement": "Vulnerability CVE-2026-107937 affects version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:43:00.050875+00:00", "status_notes": "Vulnerability CVE-2026-108039 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-108039" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:43:00.050875+00:00", "status_notes": "Vulnerability CVE-2026-49875 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-49875" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:43:00.050875+00:00", "status_notes": "Vulnerability CVE-2026-50645 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-50645" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2026-54225 affects version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-54225" }, "action_statement": "Vulnerability CVE-2026-54225 affects version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:43:00.050875+00:00", "status_notes": "Vulnerability CVE-2026-64958 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-64958" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:44:00.065178+00:00", "status_notes": "Vulnerability CVE-2026-78384 is fixed in version 3.4.5-tuxcare.2 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-78384" } } ] }