Apache · Apache Cxf · CVE-2025-48913
**Name of the Vulnerable Software and Affected Versions**
Apache CXF versions prior to 3.6.8
Apache CXF versions prior to 4.0.9
Apache CXF versions prior to 4.1.3
**Description**
If untrusted users are permitted to configure JMS (Java Message Service) for Apache CXF, they could use RMI (Remote Method Invocation) or LDAP (Lightweight Directory Access Protocol) URLs. This could potentially lead to code execution capabilities. The interface has been restricted to reject these protocols to eliminate this risk.
**Recommendations**
Upgrade to version 3.6.8
Upgrade to version 4.0.9
Upgrade to version 4.1.3