{"action":"Upgrade org.apache.cxf:cxf-rt-ws-transfer to 3.6.11 (3.6.x), 4.1.6 (4.1.x) or 4.2.1 (4.2.x) or later.","affected":[{"fixed":"4.2.1","introduced":"4.2.0"},{"fixed":"4.1.6","introduced":"4.1.0"},{"fixed":"3.6.11","introduced":"0"}],"component":"org.apache.cxf:cxf-rt-ws-transfer","cve_ids":["CVE-2026-44618"],"ecosystem":"Maven","epss":0.00538,"exploited":false,"fixed_versions":["4.2.1","4.1.6","3.6.11"],"ghsa_id":"GHSA-vmm5-fjgx-2jhp","id":"tcs_01M5N9EBYVMAEY2CSWSJM1RK0M","modified_at":"2026-06-29T23:26:32.407192Z","published_at":"2026-05-26T13:30:15Z","references":["https://osv.dev/vulnerability/GHSA-vmm5-fjgx-2jhp","https://nvd.nist.gov/vuln/detail/CVE-2026-44618","https://github.com/apache/cxf","https://lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7","http://www.openwall.com/lists/oss-security/2026/05/22/8"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-vmm5-fjgx-2jhp","url":"https://osv.dev/vulnerability/GHSA-vmm5-fjgx-2jhp"}],"summary":"Apache CXF's WS-Transfer module has an insecure XML parser configuration"}