{ "@id": "urn:uuid:224ae610-d331-478b-83de-1d8b514454e1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T05:32:00.110255+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2005-4838 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2007-1358 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. All 1 patch commits already exist in target branch", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "All 1 patch commits already exist in target branch" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2008-0128 is a false positive for org.apache.cxf:cxf 3.5.9-tuxcare.13. false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing....", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf 3.5.9-tuxcare.13. false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2012-0803 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-0803 affects Apache CXF 2.4.5 and 2.5.1 (2012), allowing authentication bypass via empty UsernameToken (specifically, UsernameToken with no password). The target runs Apache CXF 3.5.9-tuxcare.10. The vulnerability was fixed by Apache CXF upstream in commit b77e43f19d (April 2017) by introducing ENABLE_UT_NOPASSWORD_PRINCIPAL flag (default: false) that rejects UsernameTokens without pas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-0803" }, "impact_statement": "not_affected \u2014 CVE-2012-0803 affects Apache CXF 2.4.5 and 2.5.1 (2012), allowing authentication bypass via empty UsernameToken (specifically, UsernameToken with no password). The target runs Apache CXF 3.5.9-tuxcare.10. The vulnerability was fixed by Apache CXF upstream in commit b77e43f19d (April 2017) by introducing ENABLE_UT_NOPASSWORD_PRINCIPAL flag (default: false) that rejects UsernameTokens without pas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2012-2378 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.5.9 is not affected by CVE-2012-2378. The vulnerability affected versions 2.4.5-2.4.7, 2.5.1-2.5.3, and 2.6.x before 2.6.1. The fix was applied upstream in May 2012 (commit 4500bf901cb2a7312291b6663045f28a95d2a0c4) by Apache committer Colm O Heigeartaigh, adding proper validation of SupportingToken child policies (AlgorithmSuite, SignedParts, SignedElements, EncryptedParts, Encrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-2378" }, "impact_statement": "not_affected \u2014 Apache CXF 3.5.9 is not affected by CVE-2012-2378. The vulnerability affected versions 2.4.5-2.4.7, 2.5.1-2.5.3, and 2.6.x before 2.6.1. The fix was applied upstream in May 2012 (commit 4500bf901cb2a7312291b6663045f28a95d2a0c4) by Apache committer Colm O Heigeartaigh, adding proper validation of SupportingToken child policies (AlgorithmSuite, SignedParts, SignedElements, EncryptedParts, Encrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2012-2379 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-2379 affects Apache CXF versions 2.4.x-2.6.x (before 2.4.8, 2.5.4, and 2.6.1) where Supporting Tokens with child WS-SecurityPolicy directives did not properly enforce that XML elements be signed or encrypted. The target version 3.5.9-tuxcare.10 is NOT vulnerable because the fix was already present in the upstream Apache CXF release before TuxCare onboarding. Fix commit 4500bf901c (May ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-2379" }, "impact_statement": "not_affected \u2014 CVE-2012-2379 affects Apache CXF versions 2.4.x-2.6.x (before 2.4.8, 2.5.4, and 2.6.1) where Supporting Tokens with child WS-SecurityPolicy directives did not properly enforce that XML elements be signed or encrypted. The target version 3.5.9-tuxcare.10 is NOT vulnerable because the fix was already present in the upstream Apache CXF release before TuxCare onboarding. Fix commit 4500bf901c (May ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2012-3451 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.5.9 is not affected by CVE-2012-3451. The vulnerability, which allowed remote attackers to execute unintended web-service operations by sending a SOAP Action header inconsistent with the message body, was fixed by the Apache CXF project in August 2012 (commit 9c70abe28f) and further hardened in March 2020 (commit b563f7b59d). Both fixes were part of the upstream release before TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-3451" }, "impact_statement": "not_affected \u2014 Apache CXF 3.5.9 is not affected by CVE-2012-3451. The vulnerability, which allowed remote attackers to execute unintended web-service operations by sending a SOAP Action header inconsistent with the message body, was fixed by the Apache CXF project in August 2012 (commit 9c70abe28f) and further hardened in March 2020 (commit b563f7b59d). Both fixes were part of the upstream release before TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2012-5633 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-5633 affects the URIMappingInterceptor component in Apache CXF, which allowed HTTP GET requests to bypass WS-Security validation. The vulnerable component was completely removed from Apache CXF by upstream developer Daniel Kulp in commit fcc19c3ddd (2014-01-06), years before the 3.5.9 release. The target version 3.5.9-tuxcare.10 is not affected as the vulnerable code has been absent fr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5633" }, "impact_statement": "not_affected \u2014 CVE-2012-5633 affects the URIMappingInterceptor component in Apache CXF, which allowed HTTP GET requests to bypass WS-Security validation. The vulnerable component was completely removed from Apache CXF by upstream developer Daniel Kulp in commit fcc19c3ddd (2014-01-06), years before the 3.5.9 release. The target version 3.5.9-tuxcare.10 is not affected as the vulnerable code has been absent fr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2013-4444 is a false positive for org.apache.cxf:cxf 3.5.9-tuxcare.13. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2013-4444" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf 3.5.9-tuxcare.13. false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository.", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2014-0119 is a false positive for org.apache.cxf:cxf 3.5.9-tuxcare.13. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2014-0119" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2019-12406 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 CVE-2019-12406 affects Apache CXF versions before 3.3.4 and 3.2.11 that lack attachment count limits, allowing DoS via messages with excessive attachments. The target version 3.5.9 already contains the upstream fix (commit 6c3990144b) that enforces a default limit of 50 attachments (configurable via ATTACHMENT_MAX_COUNT). This fix was authored by Apache CXF maintainer Colm O hEigeartaigh and sh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12406" }, "impact_statement": "not_affected \u2014 CVE-2019-12406 affects Apache CXF versions before 3.3.4 and 3.2.11 that lack attachment count limits, allowing DoS via messages with excessive attachments. The target version 3.5.9 already contains the upstream fix (commit 6c3990144b) that enforces a default limit of 50 attachments (configurable via ATTACHMENT_MAX_COUNT). This fix was authored by Apache CXF maintainer Colm O hEigeartaigh and sh..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2019-12419 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. CVE-2019-12419 is not present in Apache CXF 3.5.9-tuxcare.10. The fix commit 337609d81a9f53e7680cb79d9ab733a79f4cd769 by upstream Apache author coheigea@apache.org was already included in the upstream Apache CXF 3.5.9 release before TuxCare onboarded it. The vulnerable code pattern (missing validation that clientId must equal principal.getName()) is not present. The target code correctly validates this at AbstractTokenService.java:81-82 and rejects mismatched requests via reportInvalidClient().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.11; >= 3.3.0, < 3.3.4), NVD (>= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.4), cve.org (< 3.3.4; < 3.2.11), Snyk (>= 3.3.0, < 3.3.4; >= 3.2.0, < 3.2.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12419" }, "impact_statement": "CVE-2019-12419 is not present in Apache CXF 3.5.9-tuxcare.10. The fix commit 337609d81a9f53e7680cb79d9ab733a79f4cd769 by upstream Apache author coheigea@apache.org was already included in the upstream Apache CXF 3.5.9 release before TuxCare onboarded it. The vulnerable code pattern (missing validation that clientId must equal principal.getName()) is not present. The target code correctly validates this at AbstractTokenService.java:81-82 and rejects mismatched requests via reportInvalidClient().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.11; >= 3.3.0, < 3.3.4), NVD (>= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.4), cve.org (< 3.3.4; < 3.2.11), Snyk (>= 3.3.0, < 3.3.4; >= 3.2.0, < 3.2.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2019-12423 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. CVE-2019-12423 is NOT present in Apache CXF 3.5.9-tuxcare.10. The vulnerability (exposure of private keys when using JWK keystores) was fixed by upstream commit 6852cd5e49 authored by coheigea@apache.org, which shipped in the upstream release that this TuxCare branch is based on. The fix adds stripPrivateParameters logic that filters out secret keys (oct type) and removes RSA private key parameters (d, p, q, dp, dq, qi) before returning keys via the OIDC/JWK keys service. The defense is active by default (stripPrivateParameters=true) in JwksService, which OidcKeysService extends.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12423" }, "impact_statement": "CVE-2019-12423 is NOT present in Apache CXF 3.5.9-tuxcare.10. The vulnerability (exposure of private keys when using JWK keystores) was fixed by upstream commit 6852cd5e49 authored by coheigea@apache.org, which shipped in the upstream release that this TuxCare branch is based on. The fix adds stripPrivateParameters logic that filters out secret keys (oct type) and removes RSA private key parameters (d, p, q, dp, dq, qi) before returning keys via the OIDC/JWK keys service. The defense is active by default (stripPrivateParameters=true) in JwksService, which OidcKeysService extends.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2019-17573 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 The target Apache CXF 3.5.9 is not affected by CVE-2019-17573 (reflected XSS in services listing page). The vulnerability was fixed by upstream Apache CXF in December 2019 (commit 4ca5f7b921 by coheigea@apache.org), which added HTML entity escaping to all URL/address outputs in the service listing pages. This fix was already present in the Apache CXF 3.5.9 release that TuxCare onboarded, as con...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17573" }, "impact_statement": "not_affected \u2014 The target Apache CXF 3.5.9 is not affected by CVE-2019-17573 (reflected XSS in services listing page). The vulnerability was fixed by upstream Apache CXF in December 2019 (commit 4ca5f7b921 by coheigea@apache.org), which added HTML entity escaping to all URL/address outputs in the service listing pages. This fix was already present in the Apache CXF 3.5.9 release that TuxCare onboarded, as con..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2020-13954 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. not_affected \u2014 CVE-2020-13954 (reflected XSS via styleSheetPath in /services page) is NOT present in target Apache CXF 3.5.9-tuxcare.10. The vulnerable pattern was removed by upstream Apache fixes (commits 3c23fa3b3c and 1cf50e500c) that shipped in the 3.5.9 release before TuxCare's involvement. The target contains both required defenses: HTML escaping via StringEscapeUtils.escapeHtml4() and multiple-slash st...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13954" }, "impact_statement": "not_affected \u2014 CVE-2020-13954 (reflected XSS via styleSheetPath in /services page) is NOT present in target Apache CXF 3.5.9-tuxcare.10. The vulnerable pattern was removed by upstream Apache fixes (commits 3c23fa3b3c and 1cf50e500c) that shipped in the 3.5.9 release before TuxCare's involvement. The target contains both required defenses: HTML escaping via StringEscapeUtils.escapeHtml4() and multiple-slash st..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2021-22696 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. The target Apache CXF 3.5.9-tuxcare.10 is NOT AFFECTED by CVE-2021-22696. The vulnerability was fixed in the upstream Apache CXF 3.4.3 release, and version 3.5.9 already contains the complete fix. The vulnerable code pattern (weak request_uri validation that only checked for https://) has been replaced with secure code that disables request_uri handling by default. The fix was authored by Apache committer coheigea@apache.org and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22696" }, "impact_statement": "The target Apache CXF 3.5.9-tuxcare.10 is NOT AFFECTED by CVE-2021-22696. The vulnerability was fixed in the upstream Apache CXF 3.4.3 release, and version 3.5.9 already contains the complete fix. The vulnerable code pattern (weak request_uri validation that only checked for https://) has been replaced with secure code that disables request_uri handling by default. The fix was authored by Apache committer coheigea@apache.org and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2021-30468 does not affect version 3.5.9-tuxcare.13 of org.apache.cxf:cxf. Apache CXF 3.5.9-tuxcare.10 is not affected by CVE-2021-30468. The vulnerability affected versions prior to 3.4.4 and 3.3.11 due to missing JSON escaping in JsonMapObjectReaderWriter, which allowed malformed JSON to cause infinite loops. The target version 3.5.9 already includes the upstream fix (commit fa01cfac79 by coheigea@apache.org) that adds proper JSON escaping via the escapeJson() method. This fix was present in the upstream Apache CXF release before TuxCare's ELS work began, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-30468" }, "impact_statement": "Apache CXF 3.5.9-tuxcare.10 is not affected by CVE-2021-30468. The vulnerability affected versions prior to 3.4.4 and 3.3.11 due to missing JSON escaping in JsonMapObjectReaderWriter, which allowed malformed JSON to cause infinite loops. The target version 3.5.9 already includes the upstream fix (commit fa01cfac79 by coheigea@apache.org) that adds proper JSON escaping via the escapeJson() method. This fix was present in the upstream Apache CXF release before TuxCare's ELS work began, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.9-tuxcare.13" } } ], "timestamp": "2026-11-09T21:03:06.161977+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf 3.5.9-tuxcare.13. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }