Messages by Thread
-
[PR] Bump cxf.johnzon.version from 2.1.0 to 2.2.0 [cxf]
via GitHub
-
[PR] Cxf 9233 fix response context [cxf]
via GitHub
-
[PR] CXF-9233: AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT is not logged [cxf]
via GitHub
-
[PR] Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 in /parent [cxf]
via GitHub
-
[PR] CXF-9237 - Add possibility to configure JCache expiry time [cxf]
via GitHub
-
[PR] Bump org.webjars:swagger-ui from 5.32.8 to 5.32.11 [cxf]
via GitHub
-
[PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.65 [cxf]
via GitHub
-
[PR] CXF-9240 - OAuthJSONProvider.appendJsonPair() does not escape JSON st… [cxf]
via GitHub
-
[PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.64 [cxf]
via GitHub
-
[PR] Bump org.apache.groovy:groovy from 5.0.7 to 5.0.8 [cxf]
via GitHub
-
[PR] Porting locking fixes to revokeRefreshToken [cxf]
via GitHub
-
[PR] Bump cxf.openwebbeans.version from 4.1.0 to 4.1.1 [cxf]
via GitHub
-
[PR] Bump actions/setup-java from 5.6.0 to 5.7.0 [cxf-build-utils]
via GitHub
-
[PR] Bump github/codeql-action/autobuild from 4.37.3 to 4.37.6 [cxf-build-utils]
via GitHub
-
[PR] Bump github/codeql-action/init from 4.37.3 to 4.37.6 [cxf-build-utils]
via GitHub
-
[PR] Bump github/codeql-action/analyze from 4.37.3 to 4.37.6 [cxf-build-utils]
via GitHub
-
[PR] Bump github/codeql-action/init from 4.37.3 to 4.37.6 [cxf]
via GitHub
-
[PR] Bump actions/setup-java from 5.6.0 to 5.7.0 [cxf]
via GitHub
-
[PR] Bump github/codeql-action/analyze from 4.37.3 to 4.37.6 [cxf]
via GitHub
-
[PR] Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.6 [cxf]
via GitHub
-
[PR] Bump actions/setup-java from 5.6.0 to 5.7.0 [cxf-xjc-utils]
via GitHub
-
[PR] Bump github/codeql-action from 4.37.3 to 4.37.6 [cxf-xjc-utils]
via GitHub
-
[PR] Fix some atomicity issues in removeCodeGrant [cxf]
via GitHub
-
[PR] Fix max_age check in OidcClientCodeRequestFilter [cxf]
via GitHub
-
[PR] Bump cxf.bcprov.version from 1.84 to 1.85 [cxf]
via GitHub
-
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
Colm O hEigeartaigh
-
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
Colm O hEigeartaigh
-
CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped
Colm O hEigeartaigh
-
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
Colm O hEigeartaigh
-
CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
Colm O hEigeartaigh
-
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider
Colm O hEigeartaigh
-
CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
Colm O hEigeartaigh
-
CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
Colm O hEigeartaigh
-
CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing
Colm O hEigeartaigh
-
CVE-2026-64958: Apache CXF: Denial of service via message header attachments
Colm O hEigeartaigh
-
CVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per message
Colm O hEigeartaigh
-
CVE-2026-54225: Apache CXF: Denial of Service attack via large attachments
Colm O hEigeartaigh
-
[PR] Bump ch.qos.logback:logback-classic from 1.5.38 to 1.6.1 [cxf]
via GitHub
-
[PR] Bump cxf.tika.version from 3.3.1 to 3.3.2 [cxf]
via GitHub
-
[PR] Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 [cxf]
via GitHub
-
[PR] Bump actions/setup-java from 5 to 5.6.0 [cxf-build-utils]
via GitHub
-
[PR] Bump cxf.hibernate.em.version from 7.4.4.Final to 7.4.5.Final [cxf]
via GitHub
-
[PR] Bump ossf/scorecard-action from 2.4.3 to 2.4.4 [cxf]
via GitHub
-
[PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 13.9.0 [cxf-xjc-utils]
via GitHub
-
[PR] Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 [cxf-xjc-utils]
via GitHub
-
[PR] Bump actions/setup-java from 5 to 5.6.0 [cxf-xjc-utils]
via GitHub
-
[PR] [CXF-9234]Concurrent DynamicClientFactory.createClient for the same W… [cxf]
via GitHub
-
[PR] Fix flaky SSE system tests [cxf]
via GitHub
-
[VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Freeman Fang
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Andriy Redko
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Alessio Soldano
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
jgenender
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Alexey Markevich
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Jamie G.
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Francesco Chicchiriccò
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Colm O hEigeartaigh
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Fabio Burzigotti via dev
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Mark Struberg via dev
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Freeman Fang
-
Re: [VOTE]Release Apache CXF 4.2.3, 4.1.8 and 3.6.12
Freeman Fang
-
[PR] Add a lock when revoking tokens [cxf]
via GitHub
-
[PR] Check if tokens have been revoked first in DefaultEncryptingOAuthData… [cxf]
via GitHub
-
[PR] Make sure the refresh token client matches that of the authenticated … [cxf]
via GitHub
-
[PR] Honor the set-remove boolean in DefaultEncryptingCodeDataProvider [cxf]
via GitHub
-
JDK 27 Rampdown Phase Closing - Default G1 in All Environments
David Delabassee via dev
-
[PR] Bump github/codeql-action from 4.37.0 to 4.37.3 [cxf-build-utils]
via GitHub
-
[PR] Bump actions/checkout from 7.0.0 to 7.0.1 [cxf-build-utils]
via GitHub
-
[PR] Make sure LazyAttachmentCollection respects max attachment count in all cases [cxf]
via GitHub
-
[PR] [CXF-9233] Ghost RESP_OUT log [cxf]
via GitHub
-
[PR] [CXF-9233] Ghost RESP_OUT log [cxf]
via GitHub
-
[PR] Bump github/codeql-action/analyze from 4.37.0 to 4.37.3 [cxf]
via GitHub
-
[PR] Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 [cxf]
via GitHub
-
[PR] Bump github/codeql-action/init from 4.37.0 to 4.37.3 [cxf]
via GitHub
-
[PR] Bump actions/checkout from 7.0.0 to 7.0.1 [cxf]
via GitHub
-
[PR] Bump github/codeql-action from 4.37.0 to 4.37.3 [cxf-xjc-utils]
via GitHub
-
[PR] Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 [cxf-xjc-utils]
via GitHub
-
[PR] Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 [cxf-build-utils]
via GitHub
-
[PR] Disable JMS ObjectMessage deserialization by default [cxf]
via GitHub
-
[PR] Update Neethi to 3.2.3 [cxf]
via GitHub
-
[PR] Update Jettison to 1.5.7 [cxf]
via GitHub
-
[PR] Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3 [cxf]
via GitHub
-
[PR] Update Groovy to 5.0.7 [cxf]
via GitHub
-
[PR] CXF-9223 - Disable audienceIsEndpointAddress on main only [cxf]
via GitHub
-
[PR] CXF-9223 - Improve prefix matching for OAuth audience URIs [cxf]
via GitHub
-
[PR] Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.63 [cxf]
via GitHub
-
[PR] Bump com.puppycrawl.tools:checkstyle from 13.7.0 to 13.8.0 [cxf]
via GitHub
-
[PR] CXF-9225 - Enforce nonce for the hybrid case [cxf]
via GitHub
-
[PR] Perform validation for OIDC self-issued tokens [cxf]
via GitHub
-
[PR] Bump org.graalvm.buildtools:native-maven-plugin from 1.1.4 to 1.1.5 [cxf]
via GitHub
-
[PR] Default to sending binary JMS messages as BytesMessages from now on, … [cxf]
via GitHub
-
[PR] Bump org.graalvm.buildtools:native-maven-plugin from 1.1.3 to 1.1.4 [cxf]
via GitHub
-
[PR] Read WSDL imports through CXF's StaxUtils instead of WSDL4J [cxf]
via GitHub