Description

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T11:16:30.583Z",
  "pubdate": "2026-08-06T11:16:30.583Z",
  "executiveSummary": "This vulnerability involves an insecure native Java deserialization flaw present within the JMS transport component of Apache CXF. Specifically, the service processes inbound JMS ObjectMessage bodies without enforcing any type restrictions during the deserialization process. This oversight creates severe security implications, as any threat actor capable of placing a crafted message directly onto the target service's JMS destination can trigger the execution of malicious payloads. The primary impact of successful exploitation includes Denial of Service (DoS) conditions and Remote Code Execution (RCE), provided that a suitable gadget class resides on the application classpath. The attack vector targets messaging infrastructure exposure points, requiring network access to the JMS broker or destination but no prior authentication if the destination is publicly or internally reachable without controls. Exploitation relies on supplying a malicious serialized object that the vulnerable component automatically processes and deserializes. To address these risks, the vendor has introduced a fix that disables ObjectMessage deserialization by default while supplying a configuration switch to re-enable the functionality if strictly necessary. Administrators and users are strongly advised to implement the official patches by upgrading to the designated secure versions to eliminate the insecure deserialization vector.",
  "technicalDetails": "The vulnerability resides in the JMS transport mechanism of Apache CXF, which is responsible for handling asynchronous messaging interactions. The vulnerable component automatically processes inbound JMS ObjectMessage instances by invoking native Java deserialization mechanisms directly on the message body. A fundamental root cause of this flaw is the complete absence of type verification, class whitelisting, or deserialization filters prior to object instantiation. Consequently, any arbitrary byte stream encapsulated within a JMS ObjectMessage is ingested and processed by the Java runtime environment underlying the Apache CXF service.\nThe attack flow proceeds as follows: First, an unauthenticated or unauthorized attacker identifies the JMS destination endpoints exposed by the Apache CXF service. Second, the attacker crafts a malicious serialized Java object designed to invoke specific hazardous operations upon instantiation. This payload often leverages known gadget chains available within libraries present on the application classpath. Third, the attacker injects this crafted payload as an JMS ObjectMessage onto the targeted JMS destination utilized by the Apache CXF JMS transport. Fourth, the Apache CXF transport layer retrieves the message and passes the raw payload directly to the native Java deserialization routine without validating the object types.\nUpon processing the malicious serialized stream, the Java runtime instantiates the object graph, triggering the execution of embedded gadget chains during the deserialization lifecycle. If the classpath contains vulnerable gadget dependencies, this execution flow culminates in Remote Code Execution with the privilege level of the Java process running the Apache CXF service. Alternatively, exploitation can result in a Denial of Service through resource exhaustion or fatal exceptions triggered during object reconstruction. The vulnerability affects Apache CXF deployments utilizing the JMS transport component across unsupported or vulnerable version branches prior to the application of the official security updates."
}