Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

CVE-2021-22696 — cxf

HIGHFix: apache/cxf@40503a5

CVE-2021-22696 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in org.apache.cxf:cxf. 1 public exploit reference exists, so weaponization risk is real. A fix is available for org.apache.cxf:cxf — see the affected versions and patch details below.

Authorization service vulnerable to DDos attacks in Apache CFX

Also known asGHSA-7q4h-pj78-j7vg
Published
Apr 2, 2021
Updated
Jul 8, 2026
Affected
4 pkgs
Patched
4 / 4
Exploits
1 known
Exploitation data as of Sep 21, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
6.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs94th percentile — riskier than 94% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

CVE-2021-22696 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.

Where this sits among everything scored

Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

4 pkgs affected
☕org.apache.cxf:cxf☕org.apache.cxf:cxf☕org.apache.cxf:apache-cxf☕org.apache.cxf:apache-cxf

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.cxf:cxf≥ 3.4.0&&< 3.4.33.4.3org.apache.cxf:cxf:3.4.3
☕Mavenorg.apache.cxf:cxfall versions3.3.10org.apache.cxf:cxf:3.3.10
☕Mavenorg.apache.cxf:apache-cxf≥ 3.4.0&&< 3.4.33.4.3org.apache.cxf:apache-cxf:3.4.3
☕Mavenorg.apache.cxf:apache-cxfall versions3.3.10org.apache.cxf:apache-cxf:3.3.10
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a…

lists.apache.orgNVDJun 2021

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.cxf:cxf, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.apache.cxf:cxf to 3.4.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-22696 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2021-22696 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2021-22696. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate
ProductFixed inAdvisory
JWS 5.7.0cxf-coreRHSA-2022:7273
Red Hat Fuse 7.10cxf-coreRHSA-2021:5134

Frequently Asked Questions

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the
O3 Security · Impact-Aware SCA

Is CVE-2021-22696 in your dependencies?

O3 Security finds CVE-2021-22696 across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
CVE-2021-22696: cxf (High 7.5) | O3 Security