Skip to content
Fencer Vulns
medium 6.5

CVE-2026-50630 json

Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

published 2026-06-12 4 mo ago modified 2026-11-05 4 d ago also GHSA-xf62-wr5p-5p95 , EUVD-2026-36398

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

Patch / fix

  • maven org.apache.cxf:cxf-rt-rs-security-oauth2 4.1.7, 4.2.2
  • Apache Software Foundation Apache CXF 3.6.12, 4.1.7, 4.2.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-50630 updated cvss 5.4

org.apache.cxf/cxf-rt-rs-security-oauth2: apache-cxf: HTTP header injection and response splitting via CRLF injection

  • Red Hat build of Apache Camel for Spring Boot 4 cxf-rt-rs-security-oauth2 Red Hat Fuse 7 cxf-rt-rs-security-oauth2 Red Hat JBoss Enterprise Application Platform Expansion Pack cxf-rt-rs-security-oauth2 Red Hat JBoss Web Server 5 cxf-rt-rs-security-oauth2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.cxf:cxf-rt-rs-security-oauth2
>=4.2.0, <4.2.2
<4.1.7
4.2.2
4.1.7

Affected products

  • Apache Software Foundation Apache CXF

Classification

Weakness
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.