CVE-2018-8038: Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when eit...

Security readout for executives and security teams

Apache CXF Fediz before 1.4.4 did not fully block XML Document Type Declarations in parts of its identity-provider processing. In plain terms, systems using vulnerable Fediz authentication components may parse XML in a less restricted way than intended. The bundle does not provide a CVSS score, confirmed impact details, or evidence of active exploitation. Exposure is limited to deployments using Apache CXF Fediz before 1.4.4, particularly Fediz plugins or Identity Provider components that parse XML-based authentication data. Organizations not using Fediz, or already on 1.4.4 or later, are not indicated as affected by the supplied sources. Set priority after confirming whether Fediz is present. If vulnerable Fediz supports authentication or federation, schedule upgrade promptly because identity infrastructure has high business sensitivity. Evidence is incomplete for severity and exploitation, so avoid emergency assumptions unless your environment exposes the affected parsing paths. Mitigation focus: Upgrade Apache CXF Fediz deployments prior to 1.4.4 to version 1.4.4 or later.; Review the Apache CXF security advisory for vendor-specific remediation guidance.; Identify Fediz application plugins that parse Identity Provider responses..

Prepared

Jun 7, 2026, 06:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.