CVE-2026-44930CWE-90

Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

Medium · published May 22, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.

Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-05-22T12:16Z
EPSS history
Timeline
  • 22 MAY 12:16Z
    Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
    cvelistv5