CVE-2026-66909
UnknownSummary
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed.
Risk Assessment
The risk includes the possibility of remote code execution on the server, which can lead to full system compromise, as well as DoS attacks. The attack requires access to the JMS queue, which may be possible for internal users or through other vulnerabilities.
Recommendation
It is recommended to immediately upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12, which fix this vulnerability. If upgrading is not possible, disable ObjectMessage deserialization in the configuration.
Original NVD description (English source)
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.