What is GHSA-qp3f-rvj8-46c8?

GHSA-qp3f-rvj8-46c8 is a security advisory published by GitHub Security Advisories with Critical severity. A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which...

Which CVE IDs does GHSA-qp3f-rvj8-46c8 cover?

GHSA-qp3f-rvj8-46c8 covers the following CVE IDs: CVE-2026-50633. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qp3f-rvj8-46c8?

GHSA-qp3f-rvj8-46c8 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-qp3f-rvj8-46c8CriticalCVSS 9.8

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which...

Vendor

GitHub Security Advisories

Published

June 12, 2026

Last Modified

June 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-50633 →

📋 Description

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-50633
https://lists.apache.org/thread/1czhgovkgzdkyp3t61wthn0foogh2grf
http://www.openwall.com/lists/oss-security/2026/06/11/10
https://github.com/advisories/GHSA-qp3f-rvj8-46c8