CVE-2026-50633: Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Published Jun 12, 2026 · Updated Aug 20, 2026
Affected packages
org.apache.cxf:cxf-integration-jca
- Ecosystem
- Maven
- Affected
- >= 4.2.0, < 4.2.2
- Fixed in
- 4.2.2
- Check
mvn dependency:tree -Dincludes=org.apache.cxf:cxf-integration-jca
org.apache.cxf:cxf-integration-jca
- Ecosystem
- Maven
- Affected
- < 4.1.7
- Fixed in
- 4.1.7
- Check
mvn dependency:tree -Dincludes=org.apache.cxf:cxf-integration-jca
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-50633
- https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf
- https://access.redhat.com/security/cve/CVE-2026-50633
- https://bugzilla.redhat.com/show_bug.cgi?id=2488307
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50633.json
- https://access.redhat.com/errata/RHSA-2026:37390
- https://github.com/advisories/GHSA-qp3f-rvj8-46c8
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology