遠端主機上安裝的 Apache CXF 版本早於 3.6.13，或為早於 4.1.9 的 4.x，或早於 4.2.4 的 4.2.x。因此，該主機會受到多個弱點影響，包括：

  - OidcClientCodeRequestFilter 中的 max_age 驗證新鮮度檢查因毫秒/秒單位不匹配和反向比較極性而無法運作。任何使用 setMaxAgeOffset 強制執行重新驗證的信賴方都會以無訊息方式接受任何年齡的工作階段，從而繞過逐步驗證原則。(CVE-2026-71575)

  - Apache CXF 的 STSTokenValidator 和安全權杖服務 (STS) 將已驗證的安全令牌緩存在該令牌的非密碼編譯 32 位元雜湊下，並將快取命中視為所呈現令牌已通過驗證的證據。攻擊者可以製作一個權杖，其哈希與快取項目衝突，該令牌無需密碼驗證、簽章信任驗證或 STS 呼叫即可接受，從而讓攻擊者可以另一個使用者的身份進行驗證。(CVE-2026-97468)

  - Netty HTTP 用戶端傳輸未驗證 TLS 憑證主機名稱，從而允許網路中間人假冒目標服務。(CVE-2026-107938)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上安装的 Apache CXF 版本低于 3.6.13，或为低于 4.1.9 的 4.x，或为低于 4.2.4 的 4.2.x。因此，该应用程序受到多个漏洞的影响，其中包括：

  - 由于毫秒/秒单位不匹配和比较极性反转，OidcClientCodeRequestFilter 中的 max_age 认证新鲜度检查不起作用。任何使用 setMaxAgeOffset 强制执行重新认证的依赖方都会静默接受任何年龄的会话，进而绕过逐步认证策略。（CVE-2026-71575）

  - Apache CXF 的 STSTokenValidator 和安全标记服务 （STS） 将经过验证的安全标记缓存在标记的非加密 32 位哈希下，并将缓存命中视为已验证所显示标记的证明。攻击者可构建一个哈希与缓存条目冲突的标记，然后无需密码验证、签名信任验证或调用 STS 即可接受该标记，从而允许攻击者认证为另一个用户。（CVE-2026-97468）

  - Netty HTTP 客户端传输未验证 TLS 证书主机名，从而允许网络中间人冒充目标服务。（CVE-2026-107938）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

リモートホストにインストールされている Apache CXF のバージョンは、3.6.13 より前、4.1.9 より前の 4.x、または 4.2.4 より前の 4.2.x です。そのため、以下を含む複数の脆弱性による影響を受けます:

  - OidcClientCodeRequestFilter の max_age 認証の鮮度チェックは、ミリ秒/秒の単位の不一致と反転した比較極性のために機能しませんでした。setMaxAgeOffset を使用して再認証を強制する場合、任意の経過時間のセッションがサイレントに受け入れられ、ステップアップ認証ポリシーがバイパスされます。(CVE-2026-71575)

  - Apache CXF の STSTokenValidator と Security Token Service (STS) は、検証済みセキュリティトークンをトークンの暗号化されていない 32 ビットハッシュでキャッシュし、キャッシュヒットを提示されたトークンが既に検証されている証拠として処理していました。攻撃者がそのハッシュがキャッシュされたエントリと衝突するトークンを細工し、パスワードの検証、署名の信頼の検証、または STS への呼び出しなしで受け入れらるようにし、攻撃者を他のユーザーとして認証させる可能性があります。(CVE-2026-97468)

  - Netty HTTP クライアントトランスポートは、TLS 証明書のホスト名を検証しませんでした。これにより、ネットワーク中間者が標的のサービスを偽装することができます。(CVE-2026-107938)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7295373 advisory.

  - In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured     attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits.
    The size limit was applied only to each physical line, not to a header value built from continuation lines     or to the combined values of a repeated header. The count limit was checked against the number of distinct     header names, not the total number of header lines. A remote, unauthenticated attacker could send a     multipart request with very large folded or repeated part headers. The server would then allocate memory     without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or     3.6.13, which fix this issue. (CVE-2026-107937)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache CXF installed on the remote host is prior to 3.6.13, or 4.x prior to 4.1.9, or 4.2.x prior to 4.2.4. It is, therefore, affected by multiple vulnerabilities, including:

  - The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a     milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset     to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication     policies. (CVE-2026-71575)

  - Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a     non-cryptographic 32-bit hash of the token, and treated a cache hit as proof that the presented token had already     been validated. An attacker could craft a token whose hash collides with a cached entry, which would then be     accepted without password validation, signature trust verification or a call to the STS, letting the attacker     authenticate as another user. (CVE-2026-97468)

  - The Netty HTTP client transport did not verify the TLS certificate hostname, allowing a network     man-in-the-middle to impersonate the target service. (CVE-2026-107938)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by multiple vulnerabilities as referenced in the 7295357 advisory.

  - A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins (*), reflects the     request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-     Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make     credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in     a loss of confidentiality. (CVE-2026-89058)

  - By default, StaxUtils placed no limit on the total number of elements or the total number of characters in     an XML document. A very large request could therefore use a lot of memory and CPU during parsing,     especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a     denial of service when no request size limit was configured. Both limits now have defaults: the maximum     element count is 100  maxChildElements (5,000,000 by default), and the maximum document size is 256M     characters. Applications that process larger documents can raise the limits with the     org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are     recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue. (CVE-2026-108039)

  - In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured     attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits.
    The size limit was applied only to each physical line, not to a header value built from continuation lines     or to the combined values of a repeated header. The count limit was checked against the number of distinct     header names, not the total number of header lines. A remote, unauthenticated attacker could send a     multipart request with very large folded or repeated part headers. The server would then allocate memory     without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or     3.6.13, which fix this issue. (CVE-2026-107937)

  - A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies     without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated     attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory     allocation, exhausting the JVM heap and resulting in a denial of service. (CVE-2026-89059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
366460	Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 多個弱點	Nessus	Misc.	2026/10/16	2026/10/19	critical
366460	Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 多个漏洞	Nessus	Misc.	2026/10/16	2026/10/19	critical
366460	Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 の複数の脆弱性	Nessus	Misc.	2026/10/16	2026/10/19	critical
379769	IBM WebSphere Application Server 9.x < 9.0.5.30 (7295373)	Nessus	Web Servers	2026/11/12	2026/11/12	high
366460	Apache CXF < 3.6.13 / 4.x < 4.1.9 / 4.2.x < 4.2.4 Multiple Vulnerabilities	Nessus	Misc.	2026/10/16	2026/10/19	critical
380923	IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.12 (7295357)	Nessus	Web Servers	2026/11/14	2026/11/14	high

偵測

搜尋 Plugin

critical

critical

critical

high

critical

high