Apache CXF and ECharts Frameworks Patch Critical Security Vulnerabilities

May 25
2 min read

Key Findings

Apache CXF framework patches three severe vulnerabilities including remote code execution, LDAP injection, and XXE attacks
LDAP injection flaw (CVE-2026-44930) allows attackers to retrieve arbitrary certificates from internal repositories
WS-Transfer XXE vulnerability (CVE-2026-44618) enables adversaries to read sensitive files and map internal networks
Incomplete RCE fix (CVE-2026-44417) creates another code execution path through JMS configuration
Apache ECharts XSS vulnerability (CVE-2026-45249) in tooltip rendering allows arbitrary browser code execution
ECharts flaw bypasses standard HTML escaping in Lines series tooltip formatter
Organizations must upgrade to patched versions immediately to prevent exploitation

Background

Apache CXF is a widely deployed open-source web services framework used by enterprises to build services across multiple protocols including SOAP and RESTful HTTP. The Apache Software Foundation recently disclosed critical security updates addressing newly discovered vulnerabilities that could compromise enterprise servers. Similarly, Apache ECharts is a popular JavaScript charting library used globally for data visualization. Both projects require immediate patching as attackers could actively exploit these flaws.

LDAP Injection Vulnerability

The XKMS server component contains an LDAP injection flaw in its Certificate repository module. Attackers could manipulate LDAP queries to retrieve arbitrary certificates from the internal repository without authorization. This vulnerability affects versions 4.2.0, 4.0.0, and older releases before 3.6.11. The flaw allows unauthorized access to sensitive certificate data that should remain protected within enterprise systems.

WS-Transfer XXE Risk

The framework's WS-Transfer functionality uses an insecure XML parser configuration that allows XML External Entity attacks. Adversaries could read sensitive files or map internal network topology by crafting malicious XML payloads. This vulnerability shares the same broad version impact across the product lifecycle, making it a widespread concern for deployed instances.

Remote Code Execution Path

Developers discovered an incomplete fix for an older RCE bug where another code path grants execution capabilities if untrusted users configure JMS settings. Although maintainers rated this as moderate severity, it still presents urgent threats to improperly isolated infrastructure environments.

ECharts Tooltip XSS Flaw

The vulnerability resides in ECharts' Lines series tooltip rendering logic. In versions before 6.1.0, the software fails to sanitize input strings properly. When developers use Lines series and tooltips without custom formatters, the application processes raw data directly and renders it through innerHTML without escaping. This bypasses the standard HTML escaping that normally protects applications, allowing malicious scripts to execute in browsers when tooltips display. Attackers could steal session tokens or hijack user accounts through this vulnerability.

Recommended Mitigation Actions

Organizations must immediately upgrade Apache CXF installations to versions 4.2.1, 4.1.6, or 3.6.11. Apache ECharts users should upgrade to version 6.1.0 if they utilize the Lines series functionality. These updates resolve the dangerous vulnerabilities without impacting existing customization options. Timely patching remains the best defense against active exploitation of these newly disclosed security flaws.

Sources

https://securityonline.info/apache-cxf-vulnerabilities-patch-guide/
https://securityonline.info/apache-echarts-xss-vulnerability-cve-2026-45249/