CVE-2017-5653: Apache Cxf

Medium severity, CVSS 5.3. EPSS: 11.2% chance of exploitation in the next 30 days.

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

Affected products

• Apache Cxf: from 3.0.0, up to and including 3.0.13; from 3.1.0, up to and including 3.1.11

Published 2017-04-18. Last modified 2026-06-17.