VYPR
Critical severity9.8NVD Advisory· Published Aug 8, 2025· Updated Jun 17, 2026

CVE-2025-48913

CVE-2025-48913

Description

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cxf:cxf-rt-transports-jmsMaven
< 3.6.83.6.8
org.apache.cxf:cxf-rt-transports-jmsMaven
>= 4.0.0, < 4.0.94.0.9
org.apache.cxf:cxf-rt-transports-jmsMaven
>= 4.1.0, < 4.1.34.1.3

Affected products

12

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.