{ "@id": "urn:uuid:5bc9a501-43f2-4e08-8f4a-f36630b425b8", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T08:56:23.894712+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2014-0035 does not affect version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2014-0035. The vulnerability, which caused UsernameToken to be transmitted in cleartext when EncryptedSupportingToken policy was used with EncryptBeforeSigning in SymmetricBinding, was fixed by upstream Apache CXF in commit 6358dc0577 (CXF-5046) on 2013-05-30. This fix was included in Apache CXF versions 2.6.13, 2.7.10, and all subsequent releases includ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0035" }, "impact_statement": "not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2014-0035. The vulnerability, which caused UsernameToken to be transmitted in cleartext when EncryptedSupportingToken policy was used with EncryptBeforeSigning in SymmetricBinding, was fixed by upstream Apache CXF in commit 6358dc0577 (CXF-5046) on 2013-05-30. This fix was included in Apache CXF versions 2.6.13, 2.7.10, and all subsequent releases includ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2014-0109 does not affect version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0109 is not present in Apache CXF 3.0.12. The vulnerability, which allowed DoS via large requests with Content-Type: text/html to SOAP endpoints, was fixed in upstream commit f8ed98e684c1a67a77ae8726db05a04a4978a445 (Feb 2014) by adding a MessageUtils.isRequestor() check. This fix was already present in the upstream 3.0.12 release when TuxCare onboarded it in Oct 2026. The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0109" }, "impact_statement": "not_affected \u2014 CVE-2014-0109 is not present in Apache CXF 3.0.12. The vulnerability, which allowed DoS via large requests with Content-Type: text/html to SOAP endpoints, was fixed in upstream commit f8ed98e684c1a67a77ae8726db05a04a4978a445 (Feb 2014) by adding a MessageUtils.isRequestor() check. This fix was already present in the upstream 3.0.12 release when TuxCare onboarded it in Oct 2026. The vulnerable c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2014-0110 does not affect version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0110 affects Apache CXF versions before 2.6.14 and 2.7.x before 2.7.11, allowing remote DoS via large invalid SOAP messages that consume /tmp disk space. Version 3.0.12 contains the upstream fix (commit c1e3bfd43e, Oct 2011) that introduced maxSize control for CachedOutputStream to prevent unbounded disk writes. The defense code exists at CachedOutputStream:437-444 and AttachmentUtil:1...", "vulnerability": { "name": "CVE-2014-0110" }, "impact_statement": "not_affected \u2014 CVE-2014-0110 affects Apache CXF versions before 2.6.14 and 2.7.x before 2.7.11, allowing remote DoS via large invalid SOAP messages that consume /tmp disk space. Version 3.0.12 contains the upstream fix (commit c1e3bfd43e, Oct 2011) that introduced maxSize control for CachedOutputStream to prevent unbounded disk writes. The defense code exists at CachedOutputStream:437-444 and AttachmentUtil:1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2016-6812 does not affect version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 The target Apache CXF 3.0.12 is not affected by CVE-2016-6812. The vulnerability involves matrix parameters (e.g., ;a=b) in URLs being reflected in HTML service list pages without sanitization, creating an XSS risk. The upstream Apache CXF 3.0.12 release already contains the fix (commit 1be97cb13a by sberyozkin@gmail.com), which strips matrix parameters before using URLs in HTML output. The fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6812" }, "impact_statement": "not_affected \u2014 The target Apache CXF 3.0.12 is not affected by CVE-2016-6812. The vulnerability involves matrix parameters (e.g., ;a=b) in URLs being reflected in HTML service list pages without sanitization, creating an XSS risk. The upstream Apache CXF 3.0.12 release already contains the fix (commit 1be97cb13a by sberyozkin@gmail.com), which strips matrix parameters before using URLs in HTML output. The fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2016-8739 does not affect version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core. Target Apache CXF 3.0.12 is NOT affected by CVE-2016-8739 (XXE in Atom MessageBodyReaders). The upstream vendor fixed this vulnerability in the 3.0.12 release by changing AbstractAtomProvider to use StaxUtils.createXMLStreamReader() instead of directly parsing InputStream with Abdera parser. StaxUtils applies secure defaults (SUPPORT_DTD=false, IS_REPLACING_ENTITY_REFERENCES=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false) that prevent XXE attacks. Fix commit 8e4970d931ae72f92c54d170a844b37137b8fda6 authored by sberyozkin@gmail.com (upstream Apache CXF developer) is present in HEAD and was part of the upstream 3.0.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-8739" }, "impact_statement": "Target Apache CXF 3.0.12 is NOT affected by CVE-2016-8739 (XXE in Atom MessageBodyReaders). The upstream vendor fixed this vulnerability in the 3.0.12 release by changing AbstractAtomProvider to use StaxUtils.createXMLStreamReader() instead of directly parsing InputStream with Abdera parser. StaxUtils applies secure defaults (SUPPORT_DTD=false, IS_REPLACING_ENTITY_REFERENCES=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false) that prevent XXE attacks. Fix commit 8e4970d931ae72f92c54d170a844b37137b8fda6 authored by sberyozkin@gmail.com (upstream Apache CXF developer) is present in HEAD and was part of the upstream 3.0.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2017-12624 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2017-12624" }, "action_statement": "Vulnerability CVE-2017-12624 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2017-5653 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2017-5653" }, "action_statement": "Vulnerability CVE-2017-5653 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2017-5656 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2017-5656" }, "action_statement": "Vulnerability CVE-2017-5656 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2022-46363 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2022-46363" }, "action_statement": "Vulnerability CVE-2022-46363 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2022-46364 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2022-46364" }, "action_statement": "Vulnerability CVE-2022-46364 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2025-23184 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2025-23184" }, "action_statement": "Vulnerability CVE-2025-23184 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2025-48795 does not affect version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 Version 3.0.12 is not affected by CVE-2025-48795. The vulnerability requires DelayedCachedOutputStreamCleaner class which logs unclosed streams by calling toString() on CachedOutputStream objects, triggering a full read of cached temp files into memory. This class does not exist in version 3.0.12 - it was introduced in later versions (3.5.x+). While the underlying data flaw exists (CachedOutput...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-48795" }, "impact_statement": "not_affected \u2014 Version 3.0.12 is not affected by CVE-2025-48795. The vulnerability requires DelayedCachedOutputStreamCleaner class which logs unclosed streams by calling toString() on CachedOutputStream objects, triggering a full read of cached temp files into memory. This class does not exist in version 3.0.12 - it was introduced in later versions (3.5.x+). While the underlying data flaw exists (CachedOutput..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-107937 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-107937" }, "action_statement": "Vulnerability CVE-2026-107937 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-108039 is fixed in version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-108039" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-49875 is fixed in version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-49875" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-50645 is fixed in version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-50645" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-54225 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-54225" }, "action_statement": "Vulnerability CVE-2026-54225 affects version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-64958 is fixed in version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-64958" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-core@3.0.12-tuxcare.4" } } ], "timestamp": "2026-11-12T08:56:23.894712+00:00", "status_notes": "Vulnerability CVE-2026-78384 is fixed in version 3.0.12-tuxcare.4 of org.apache.cxf:cxf-core.", "vulnerability": { "name": "CVE-2026-78384" } } ] }