CVE-2026-50630

MEDIUM EPSS 32.2%
Published Jun 12, 20262w ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Jun 12, 2026 2w ago
Last Modified Jun 17, 2026 2w ago

Description

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

CVSS Details

Base Score
6.5
Exploitability
3.9
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
32.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-113

Affected Products 2

VendorProductVersionRange
apachecxf* <4.1.7
apachecxf*≥4.2.0  –  <4.2.2

References 2

  • openwall.com http://www.openwall.com/lists/oss-security/2026/06/11/7
    Mailing ListThird Party Advisory
  • lists.apache.org https://lists.apache.org/thread/bt7vnjzzkpd6vdhkxv103poor1jy5trm
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.