CVE-2026-44930: Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44930?
CVE-2026-44930 has a risk rating of 28, indicating a high severity vulnerability.
How do I fix CVE-2026-44930?
To fix CVE-2026-44930, upgrade to Apache CXF version 4.2.1, 4.1.6, or 3.6.11.
What is the impact of CVE-2026-44930?
CVE-2026-44930 allows attackers to perform LDAP injection, potentially retrieving arbitrary certificates from the XKMS LDAP repository.
Which versions of Apache CXF are affected by CVE-2026-44930?
Versions prior to 4.2.1, 4.1.6, and 3.6.11 of Apache CXF are affected by CVE-2026-44930.
When was CVE-2026-44930 published?
CVE-2026-44930 was published on May 22, 2026.