Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨*CVE* CVE-2026-65432 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any
Post summary
The post announces CVE-2026-65432 involving Apache CXF’s WSDL handling, noting its hardened StaxUtils path but providing no PoC, exploit, or patch details.
CVE-2026-65432 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> refer… https://www.cve.org/CVERecord?id=CVE-2026-65432
Post summary
The post briefly discloses vulnerability details of CVE‑2026‑65432, noting how Apache CXF's WSDL parsing can be exploited via imports, without providing PoC, patch, or exploitation evidence.
CVE-2026-65432 XML External Entity Injection in Apache CXF WSDL Import Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-65432
Post summary
The content announces CVE-2026-65432 as an XML External Entity injection flaw in Apache CXF’s WSDL import, with a reference link, but does not provide exploit code, evidence of active exploitation, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cxf | - | - | - |