issues  

Messages by Thread

• [jira] [Resolved] (CXF-7514) IOUtils.isEmpty returns false if isAvailable is zero and no marks are supported Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-7560) @WebMethod(exclude=true) is not being honored when generating WSDL Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-6672) PollingMessageListenerContainer does fail silently upon java.lang.Error Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-6672) PollingMessageListenerContainer does fail silently upon java.lang.Error Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-6532) Consider implementing Json Clear Signature spec Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-7274) Improve OAuth2 incremental authorization support Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-7624) Support OpenTracing Tracer as JAX-RS context Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9107) Clean up stream resource leaks Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-4740) SSL/TLS server incorrectly closes socket before reporting certificate failure to client Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-6017) Optimize Jwe and Jws reader interceptors Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-3963) Make a maven site, at least for the plugins Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-7275) Support for OAuth2 token exchange Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8305) WSDL2Java generates java code that won't compile for array of byte arrays Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-7997) The PhaseInterceptor returning null when deployed on Payara server Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8034) Initial support for the JOSE authenticated encryption Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-7523) JaxWsDynamicClientFactory loads WSDL generated POJO's in classpath only "once" Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8634) Problem with update to cxf 3.5.0 Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8658) CXF 3.4.5 breaks binary compatibility with 3.4.1 in TypeClassInitializer Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9032) JWK keystore type is not getting loaded if JWT contains x5t header Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8651) JOSE: JwsJwtCompactProducer not parsing headers properly if the claims contains \n Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8793) Unable to locate Spring NamespaceHandler for XML schema namespace [http://cxf.apache.org/jaxrs] after updating CXF to 3.5.3 Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8900) cxf-xjc-plugin: code generated is half javax.xml.bind.annotation, half jakarta.xml.bind.annotation Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
  • [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• [jira] [Updated] (CXF-9032) JWK keystore type is not getting loaded if JWT contains x5t header Colm O hEigeartaigh (Jira)
• [jira] [Created] (CXF-9252) Enforce audience validation on some CXF Oauth2 filters Colm O hEigeartaigh (Jira)
• [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
  • [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
  • [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• [jira] [Created] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• [jira] [Resolved] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Sebastian Schubert (Jira)
• [jira] [Assigned] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Freeman Yue Fang (Jira)
• [jira] [Updated] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Sebastian Schubert (Jira)
  • [jira] [Updated] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Sebastian Schubert (Jira)
• [jira] [Closed] (CXF-9249) Delegate JAXP parser configuration to Apache Commons Secure XML Gary D. Gregory (Jira)
• [jira] [Created] (CXF-9249) Delegate JAXP parser configuration to Apache Commons Secure XML Gary D. Gregory (Jira)
• [jira] [Created] (CXF-9248) Delegate JAXP parser configuration to Apache Commons Secure XML Piotr Karwasz (Jira)
• [jira] [Comment Edited] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Colm O hEigeartaigh (Jira)
• [jira] [Closed] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Colm O hEigeartaigh (Jira)
• [jira] [Commented] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
  • [jira] [Updated] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
  • [jira] [Updated] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
• [jira] [Created] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
• [jira] [Resolved] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• [jira] [Updated] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
  • [jira] [Updated] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• [jira] [Commented] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• [jira] [Resolved] (CXF-9246) Race condition in threaded ConnectorServerFactory Andriy Redko (Jira)
• [jira] [Commented] (CXF-9246) Race condition in threaded ConnectorServerFactory Andriy Redko (Jira)
• [jira] [Created] (CXF-9246) Race condition in threaded ConnectorServerFactory ytwang (Jira)
• [jira] [Assigned] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• [jira] [Created] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Benjamin Marwell (Jira)
• [jira] [Resolved] (CXF-8913) Avoid 3rd party maven repository for OpenSAML Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Andriy Redko (Jira)
• [jira] [Resolved] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• [jira] [Closed] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire Colm O hEigeartaigh (Jira)
• [jira] [Created] (CXF-9244) Remove Hawk functionality Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
  • [jira] [Updated] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Guanping Zhang (Jira)
• [jira] [Created] (CXF-9242) JwtAccessTokenValidator accepts absent `typ` header; OIDC IdP issues id_tokens without `typ`, enabling token confusion in misconfigured RS Guanping Zhang (Jira)
• [jira] [Assigned] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• [jira] [Assigned] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Andriy Redko (Jira)
• [jira] [Created] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Guanping Zhang (Jira)
• [jira] [Commented] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
  • [jira] [Updated] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
  • [jira] [Assigned] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
  • [jira] [Updated] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• [jira] [Created] (CXF-9238) AbstractAccessTokenValidator validation cache evicts ALL entries via clear() on overflow — replace with LRU to avoid cache-thrash Guanping Zhang (Jira)
• [jira] [Created] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Guanping Zhang (Jira)
• [jira] [Created] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap Guanping Zhang (Jira)
• [jira] [Updated] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire Guanping Zhang (Jira)
• [jira] [Created] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Guanping Zhang (Jira)
• [jira] [Created] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire Guanping Zhang (Jira)
• [jira] [Commented] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Guanping Zhang (Jira)
  • [jira] [Commented] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
• [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
  • [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
  • [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• [jira] [Resolved] (CXF-9234) Concurrent DynamicClientFactory.createClient for the same WSDL url corrupts the cached schema DOM and spins forever at 100% CPU Freeman Yue Fang (Jira)
• [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
  • [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
  • [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
  • [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
  • [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
  • [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
  • [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• [jira] [Updated] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request Neena Jacob (Jira)
  • [jira] [Updated] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request Neena Jacob (Jira)
  • [jira] [Updated] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request Neena Jacob (Jira)
  • [jira] [Updated] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request Neena Jacob (Jira)
• [jira] [Created] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request Neena Jacob (Jira)
• [jira] [Updated] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Updated] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Updated] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Andriy Redko (Jira)
• [jira] [Updated] (CXF-9220) Remove Apache Derby since it is retired Andriy Redko (Jira)
  • [jira] [Updated] (CXF-9220) Remove Apache Derby since it is retired Freeman Yue Fang (Jira)
• [jira] [Assigned] (CXF-9234) Concurrent DynamicClientFactory.createClient for the same WSDL url corrupts the cached schema DOM and spins forever at 100% CPU Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9234) Concurrent DynamicClientFactory.createClient for the same WSDL url corrupts the cached schema DOM and spins forever at 100% CPU David Richter (Jira)
• [jira] [Comment Edited] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Comment Edited] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Comment Edited] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Comment Edited] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
• [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
  • [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
• [jira] [Created] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
• [jira] [Resolved] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access Colm O hEigeartaigh (Jira)
• [jira] [Commented] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access Colm O hEigeartaigh (Jira)
  • [jira] [Updated] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-9225) OIDC RP does not enforce nonce validation for Implicit/Hybrid flows Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9225) OIDC RP does not enforce nonce validation for Implicit/Hybrid flows Colm O hEigeartaigh (Jira)
  • [jira] [Updated] (CXF-9225) OIDC RP does not enforce nonce validation for Implicit/Hybrid flows Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9225) OIDC RP does not enforce nonce validation for Implicit/Hybrid flows Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (CXF-8780) 3.5.4 Version - org.apache.cxf.common.util.ReflectionUtil.getDeclaredMethod no such method error Colm O hEigeartaigh (Jira)
• [jira] [Reopened] (CXF-8998) cxf-codegen-plugin - debug output velocity Karl Heinz Marbaise (Jira)
• [jira] [Created] (CXF-9232) Implement JTI/Assertion-ID replay cache for SAML and JWT bearer grants (Close //TODO) Guanping Zhang (Jira)
• [jira] [Commented] (CXF-9231) sign/verify and encrypt/decrypt soap payload with PQC compatible Alg Freeman Yue Fang (Jira)
• [jira] [Assigned] (CXF-9231) sign/verify and encrypt/decrypt soap payload with PQC compatible Alg Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9231) sign/verify and encrypt/decrypt soap payload with PQC compatible Alg Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
• [jira] [Updated] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
• [jira] [Comment Edited] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
  • [jira] [Comment Edited] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9230) Update to Spring Boot 4.1 release line Andriy Redko (Jira)
• [jira] [Created] (CXF-9230) Update to Spring Boot 4.1 release line Andriy Redko (Jira)
• [jira] [Commented] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
  • [jira] [Commented] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9228) Post-Quantum Cryptography (PQC) Readiness Freeman Yue Fang (Jira)
• [jira] [Assigned] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9229) Prove that CXF can support Post-Quantum Cryptography TLS using the X25519MLKEM768 hybrid key-encapsulation mechanism (KEM). Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9161) Some of the OIDCFlowTest fail with timeout (JPA only) when HttpClient instance is shared Andriy Redko (Jira)
• [jira] [Resolved] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Freeman Yue Fang (Jira)
• [jira] [Commented] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Fabio Burzigotti (Jira)
  • [jira] [Commented] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Freeman Yue Fang (Jira)
  • [jira] [Commented] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Fabio Burzigotti (Jira)
• [jira] [Resolved] (CXF-9222) partialMatchScopeValidation allows prefix-based scope escalation (e.g., read grants readwrite) Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Freeman Yue Fang (Jira)
  • [jira] [Updated] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Colm O hEigeartaigh (Jira)
• [jira] [Created] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Freeman Yue Fang (Jira)
• [jira] [Assigned] (CXF-9227) CXF 4.1.7 regression: more SecurityManager permission requirements Freeman Yue Fang (Jira)
• [jira] [Commented] (CXF-9222) partialMatchScopeValidation allows prefix-based scope escalation (e.g., read grants readwrite) Colm O hEigeartaigh (Jira)
• [jira] [Updated] (CXF-9222) partialMatchScopeValidation allows prefix-based scope escalation (e.g., read grants readwrite) Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9222) partialMatchScopeValidation allows prefix-based scope escalation (e.g., read grants readwrite) Colm O hEigeartaigh (Jira)
• [jira] [Commented] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Freeman Yue Fang (Jira)
  • [jira] [Commented] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Reto Weiss (Jira)
• [jira] [Assigned] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Freeman Yue Fang (Jira)
• [jira] [Updated] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Reto Weiss (Jira)
  • [jira] [Updated] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Freeman Yue Fang (Jira)
  • [jira] [Updated] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Freeman Yue Fang (Jira)
• [jira] [Created] (CXF-9226) Proxy authentication fails with IllegalStateException instead of HTTPException (407) Reto Weiss (Jira)
• [jira] [Resolved] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
• [jira] [Assigned] (CXF-9224) Authorization responses omit RFC 9207 iss parameter, exposing clients to OAuth mix-up attacks Colm O hEigeartaigh (Jira)
  • [jira] [Assigned] (CXF-9224) Authorization responses omit RFC 9207 iss parameter, exposing clients to OAuth mix-up attacks Colm O hEigeartaigh (Jira)
  • [jira] [Assigned] (CXF-9224) Authorization responses omit RFC 9207 iss parameter, exposing clients to OAuth mix-up attacks Colm O hEigeartaigh (Jira)
  • [jira] [Assigned] (CXF-9224) Authorization responses omit RFC 9207 iss parameter, exposing clients to OAuth mix-up attacks Colm O hEigeartaigh (Jira)
• [jira] [Assigned] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
• [jira] [Created] (CXF-9225) OIDC RP does not enforce nonce validation for Implicit/Hybrid flows Guanping Zhang (Jira)
• [jira] [Created] (CXF-9224) Authorization responses omit RFC 9207 iss parameter, exposing clients to OAuth mix-up attacks Guanping Zhang (Jira)
• [jira] [Created] (CXF-9223) completeAudienceMatch=false defaults to prefix matching for audience validation, widening resource access Guanping Zhang (Jira)
• [jira] [Created] (CXF-9222) partialMatchScopeValidation allows prefix-based scope escalation (e.g., read grants readwrite) Guanping Zhang (Jira)
• [jira] [Updated] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Guanping Zhang (Jira)
  • [jira] [Updated] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
  • [jira] [Updated] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
  • [jira] [Updated] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
• [jira] [Created] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Guanping Zhang (Jira)
• [jira] [Created] (CXF-9220) Remove Apache Derby since it is retired Andriy Redko (Jira)
• [jira] [Resolved] (CXF-9219) cxf-bom manages dependencies for 4.x that no longer exist or are not published Andriy Redko (Jira)
• [jira] [Assigned] (CXF-9219) cxf-bom manages dependencies for 4.x that no longer exist or are not published Andriy Redko (Jira)
• [jira] [Updated] (CXF-9219) cxf-bom manages dependencies for 4.x that no longer exist or are not published Andriy Redko (Jira)
• [jira] [Created] (CXF-9219) cxf-bom manages dependencies for 4.x that no longer exist or are not published James Hutton (Jira)
• [jira] [Updated] (CXF-8926) MTOM - Lock while processing attachment Freeman Yue Fang (Jira)
  • [jira] [Updated] (CXF-8926) MTOM - Lock while processing attachment mircea (Jira)
  • [jira] [Updated] (CXF-8926) MTOM - Lock while processing attachment mircea (Jira)
• [jira] [Assigned] (CXF-8926) MTOM - Lock while processing attachment Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9213) RetryStrategy is a stateful class whose objects shouldn't be reused Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9218) Respect configured ProxySelector instead of hard-wiring system proxy properties Freeman Yue Fang (Jira)
• [jira] [Resolved] (CXF-9129) Chunked attachment streaming not working when using ws-security Freeman Yue Fang (Jira)
• [jira] [Assigned] (CXF-9218) Respect configured ProxySelector instead of hard-wiring system proxy properties Freeman Yue Fang (Jira)
• [jira] [Commented] (CXF-9218) Respect configured ProxySelector instead of hard-wiring system proxy properties Freeman Yue Fang (Jira)
  • [jira] [Commented] (CXF-9218) Respect configured ProxySelector instead of hard-wiring system proxy properties Matthias Pretzer (Jira)
• [jira] [Created] (CXF-9218) Respect configured ProxySelector instead of hard-wiring system proxy properties Matthias Pretzer (Jira)
• [jira] [Assigned] (CXF-9129) Chunked attachment streaming not working when using ws-security Freeman Yue Fang (Jira)

• Earlier messages