CVE-2026-44930

CVE-2026-44930: Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

Vendor Apache Software Foundation

Product Apache CXF

Weakness CWE-90 · LDAP injection

Published May 22, 2026

Last update July 15, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

Key dates

02Disclosure timeline

May 22, 2026 CVE published

July 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-44930 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/90.html AskarLabs — CWE-90 write-up LDAP Injection

Related vulnerabilities

Identifiers

CVE CVE-2026-44930

CWE CWE-90

Affected versions

Vendor Apache Software Foundation

Product Apache CXF

Affected ≥ 4.2.0 and < 4.2.1

Vendor Apache Software Foundation

Product Apache CXF

Affected ≥ 4.0.0 and < 4.1.6

Vendor Apache Software Foundation

Product Apache CXF

Affected < 3.6.11

CVE-2026-44930: Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

01Description

02Disclosure timeline

03References

04Related CVE