issues  

Messages by Date

• 2026/10/10 [jira] [Updated] (CXF-9257) Client futures never complete if the async callback throws Markus Heiden (Jira)
• 2026/10/10 [jira] [Updated] (CXF-9257) Client futures never complete if the async callback throws Markus Heiden (Jira)
• 2026/10/10 [jira] [Created] (CXF-9257) Client futures never complete if the async callback throws Markus Heiden (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-5398) Suppressed deprecations using BeanDefinitionBuilder.addConstructorArg causing issues with Spring STS 3.4.0.201310051539-RELEASE Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-7297) Improve the way CXF endpoint metrics are shown in Spring Boot Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-8328) CVE-2019-12406 not fixed in 3.1 branch Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-8065) Stop using static factories in StaxUtils Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-3438) Karaf command line commands for CXF Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-3520) CXF support for cross domain SSO based on SAML token Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-1764) No support for attributes in JavaScript code generator Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-5901) Investigate how WebSocket Transport can support CORS Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-6225) HC AsyncConduit should accept custom ConnectionManagers Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-5641) WebSocket transport should support alternative bindings Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-7128) Review the possibility of using OWASP Sanitizer in FormattedServiceListWriter Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-6911) Create JWE JSON streaming out interceptor Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-7377) DynamicRegistrationService should support getting initial AT from a secure provider Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-7472) Provide LocalTransport Continuation Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-7455) IndexOutOfBoundsException when message part is missing Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-5028) XKMS: configurable LDAP schema parameters Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-6594) Rewrite the way JAX-RS thread local proxies are managed Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-6626) CXFServlet should be able to load contexts as Strategies Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Resolved] (CXF-7370) Node.js support for wsdl2js goal of the Maven code generation plugin Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Updated] (CXF-7455) IndexOutOfBoundsException when message part is missing Colm O hEigeartaigh (Jira)
• 2026/10/09 [jira] [Assigned] (CXF-7455) IndexOutOfBoundsException when message part is missing Colm O hEigeartaigh (Jira)
• 2026/10/08 [jira] [Resolved] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/08 [jira] [Updated] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/08 [jira] [Assigned] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/08 [jira] [Resolved] (CXF-5502) WsdlServiceFactory does not fill service endpoints Colm O hEigeartaigh (Jira)
• 2026/10/08 [jira] [Updated] (CXF-5502) WsdlServiceFactory does not fill service endpoints Colm O hEigeartaigh (Jira)
• 2026/10/08 [jira] [Assigned] (CXF-5502) WsdlServiceFactory does not fill service endpoints Colm O hEigeartaigh (Jira)
• 2026/10/08 [jira] [Created] (CXF-9256) Re-enable kerberos tests on IBM Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Valentino Porta (Jira)
• 2026/10/07 [jira] [Comment Edited] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Reopened] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/07 [jira] [Updated] (CXF-9255) WS-RM: retransmissions of messages cached in the same millisecond may run out of order and stall in-order delivery until the receive timeout Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/07 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Comment Edited] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-9255) WS-RM: retransmissions of messages cached in the same millisecond may run out of order and stall in-order delivery until the receive timeout Freeman Yue Fang (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5727) Develop a new Jndi based local transport which supports war-war comms Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5820) Update Transform feature to support simple structured paths Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-8552) NoClassDefFoundError java.io.DeleteOnExitHook in Java 14 Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-8728) Potential Refactoring Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5441) Enable optional auto-discovery of WS service beans with a new jaxws:endpoint base-packages attribute Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-6171) JAX-RS JAXB provider should check XmlElementWrapper when working with collections Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5816) Get search beans optionally cached Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5638) Default WebSocket binding should optimize the metadata and optionally not write it Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-6013) Incorrect relative schemaLocation presentation in published WSDL Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-6835) Deadlock in WS-Discovery when service called during startup Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-7538) SOAP header silently removed in case of missing configuration parameters Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5310) Support Bean Validation API for JAX-WS non-singleton service objects Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5670) Create JAX-RS service for letting resource owners manage pre-authorized and existing access tokens Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-5669) Create JAX-RS service for managing 3rd party client registrations Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-6874) NPE During Code Generation By Maven Plug-In If Name Collision Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Resolved] (CXF-6978) Make SwaggerUiResource Path configurable Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Assigned] (CXF-7538) SOAP header silently removed in case of missing configuration parameters Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Updated] (CXF-7538) SOAP header silently removed in case of missing configuration parameters Colm O hEigeartaigh (Jira)
• 2026/10/07 [jira] [Commented] (CXF-9254) Shipped xmlschema-core : 2.3.2 is vulnerable (CVE-2026-102495) Andriy Redko (Jira)
• 2026/10/07 [jira] [Commented] (CXF-9254) Shipped xmlschema-core : 2.3.2 is vulnerable (CVE-2026-102495) Benjamin Marwell (Jira)
• 2026/10/06 [jira] [Resolved] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/06 [jira] [Created] (CXF-9255) WS-RM: retransmissions of messages cached in the same millisecond may run out of order and stall in-order delivery until the receive timeout Freeman Yue Fang (Jira)
• 2026/10/06 [jira] [Assigned] (CXF-9255) WS-RM: retransmissions of messages cached in the same millisecond may run out of order and stall in-order delivery until the receive timeout Freeman Yue Fang (Jira)
• 2026/10/06 [jira] [Updated] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/06 [jira] [Updated] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/06 [jira] [Commented] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/06 [jira] [Comment Edited] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Fabio Burzigotti (Jira)
• 2026/10/06 [jira] [Comment Edited] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Fabio Burzigotti (Jira)
• 2026/10/06 [jira] [Commented] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Fabio Burzigotti (Jira)
• 2026/10/06 [jira] [Commented] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/06 [jira] [Commented] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Fabio Burzigotti (Jira)
• 2026/10/06 [jira] [Updated] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Fabio Burzigotti (Jira)
• 2026/10/05 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/05 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/05 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Andriy Redko (Jira)
• 2026/10/05 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Valentino Porta (Jira)
• 2026/10/05 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and IOException Connection Reset by peer Valentino Porta (Jira)
• 2026/10/05 [jira] [Commented] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Freeman Yue Fang (Jira)
• 2026/10/05 [jira] [Updated] (CXF-9254) Shipped xmlschema-core : 2.3.2 is vulnerable (CVE-2026-102495) Andriy Redko (Jira)
• 2026/10/05 [jira] [Resolved] (CXF-9254) Shipped xmlschema-core : 2.3.2 is vulnerable (CVE-2026-102495) Andriy Redko (Jira)
• 2026/10/05 [jira] [Created] (CXF-9254) Shipped xmlschema-core : 2.3.2 is vulnerable (CVE-2026-102495) Benjamin Marwell (Jira)
• 2026/10/03 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/10/03 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/10/03 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/10/03 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/10/02 [jira] [Created] (CXF-9253) 4.1.9 breaks WSS4J WSHandler:checkSignatureConfirmation unless 4.0.2 is used Fabio Burzigotti (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9109) MAX_PER_HOST_CONNECTIONS does not work Freeman Yue Fang (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9220) Remove Apache Derby since it is retired Freeman Yue Fang (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9126) LEAKs reported when running cxf-systests-transport-netty with 'paranoid' detection level Freeman Yue Fang (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9072) NewCookieHeaderProvider does not support SameSite attribute on cookies Freeman Yue Fang (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9109) MAX_PER_HOST_CONNECTIONS does not work Freeman Yue Fang (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9061) Update documentation to use Jakarta namespaces as well (where appropriate) Freeman Yue Fang (Jira)
• 2026/10/01 [jira] [Updated] (CXF-9035) Fix java.util.ConcurrentModificationException at org.apache.cxf.message.MessageImpl.calcContextCache Freeman Yue Fang (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7514) IOUtils.isEmpty returns false if isAvailable is zero and no marks are supported Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7560) @WebMethod(exclude=true) is not being honored when generating WSDL Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Updated] (CXF-6672) PollingMessageListenerContainer does fail silently upon java.lang.Error Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-6672) PollingMessageListenerContainer does fail silently upon java.lang.Error Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-6532) Consider implementing Json Clear Signature spec Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7274) Improve OAuth2 incremental authorization support Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7624) Support OpenTracing Tracer as JAX-RS context Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Updated] (CXF-9107) Clean up stream resource leaks Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-9107) Clean up stream resource leaks Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-4740) SSL/TLS server incorrectly closes socket before reporting certificate failure to client Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-6017) Optimize Jwe and Jws reader interceptors Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-3963) Make a maven site, at least for the plugins Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7275) Support for OAuth2 token exchange Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8305) WSDL2Java generates java code that won't compile for array of byte arrays Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7997) The PhaseInterceptor returning null when deployed on Payara server Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8034) Initial support for the JOSE authenticated encryption Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-7523) JaxWsDynamicClientFactory loads WSDL generated POJO's in classpath only "once" Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8634) Problem with update to cxf 3.5.0 Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8658) CXF 3.4.5 breaks binary compatibility with 3.4.1 in TypeClassInitializer Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-9032) JWK keystore type is not getting loaded if JWT contains x5t header Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8651) JOSE: JwsJwtCompactProducer not parsing headers properly if the claims contains \n Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8793) Unable to locate Spring NamespaceHandler for XML schema namespace [http://cxf.apache.org/jaxrs] after updating CXF to 3.5.3 Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Resolved] (CXF-8900) cxf-xjc-plugin: code generated is half javax.xml.bind.annotation, half jakarta.xml.bind.annotation Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/09/30 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/09/30 [jira] [Updated] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/09/30 [jira] [Updated] (CXF-9032) JWK keystore type is not getting loaded if JWT contains x5t header Colm O hEigeartaigh (Jira)
• 2026/09/30 [jira] [Created] (CXF-9252) Enforce audience validation on some CXF Oauth2 filters Colm O hEigeartaigh (Jira)
• 2026/09/29 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/09/29 [jira] [Commented] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/09/29 [jira] [Created] (CXF-9251) Possible Memory Leak with DelayedCachedOutputStreamCleaner and double callback REQ_OUT/RESP_OUT logging Valentino Porta (Jira)
• 2026/09/28 [jira] [Resolved] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Freeman Yue Fang (Jira)
• 2026/09/28 [jira] [Created] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Sebastian Schubert (Jira)
• 2026/09/28 [jira] [Assigned] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Freeman Yue Fang (Jira)
• 2026/09/28 [jira] [Updated] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Sebastian Schubert (Jira)
• 2026/09/28 [jira] [Updated] (CXF-9250) HttpClientHTTPConduit: failed exchange without request body is re-sent endlessly from the exceptionally callback (e.g. remote WSDL fetch) Sebastian Schubert (Jira)
• 2026/09/26 [jira] [Closed] (CXF-9249) Delegate JAXP parser configuration to Apache Commons Secure XML Gary D. Gregory (Jira)
• 2026/09/26 [jira] [Created] (CXF-9249) Delegate JAXP parser configuration to Apache Commons Secure XML Gary D. Gregory (Jira)
• 2026/09/26 [jira] [Created] (CXF-9248) Delegate JAXP parser configuration to Apache Commons Secure XML Piotr Karwasz (Jira)
• 2026/09/24 [jira] [Comment Edited] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Colm O hEigeartaigh (Jira)
• 2026/09/24 [jira] [Closed] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Colm O hEigeartaigh (Jira)
• 2026/09/24 [jira] [Commented] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Colm O hEigeartaigh (Jira)
• 2026/09/22 [jira] [Updated] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
• 2026/09/22 [jira] [Updated] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
• 2026/09/22 [jira] [Updated] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
• 2026/09/22 [jira] [Created] (CXF-9247) Support Jakarta EE 12 Andriy Redko (Jira)
• 2026/09/17 [jira] [Resolved] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• 2026/09/16 [jira] [Updated] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• 2026/09/16 [jira] [Updated] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• 2026/09/15 [jira] [Commented] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• 2026/09/09 [jira] [Resolved] (CXF-9246) Race condition in threaded ConnectorServerFactory Andriy Redko (Jira)
• 2026/09/09 [jira] [Commented] (CXF-9246) Race condition in threaded ConnectorServerFactory Andriy Redko (Jira)
• 2026/09/08 [jira] [Created] (CXF-9246) Race condition in threaded ConnectorServerFactory ytwang (Jira)
• 2026/08/31 [jira] [Assigned] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Andriy Redko (Jira)
• 2026/08/31 [jira] [Created] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() Benjamin Marwell (Jira)
• 2026/08/25 [jira] [Commented] (CXF-8913) Avoid 3rd party maven repository for OpenSAML Colm O hEigeartaigh (Jira)
• 2026/08/25 [jira] [Resolved] (CXF-8913) Avoid 3rd party maven repository for OpenSAML Colm O hEigeartaigh (Jira)
• 2026/08/25 [jira] [Commented] (CXF-8913) Avoid 3rd party maven repository for OpenSAML Claus Ibsen (Jira)
• 2026/08/25 [jira] [Commented] (CXF-8913) Avoid 3rd party maven repository for OpenSAML Colm O hEigeartaigh (Jira)
• 2026/08/25 [jira] [Commented] (CXF-8913) Avoid 3rd party maven repository for OpenSAML Thomas Beckers (Jira)
• 2026/08/24 [jira] [Resolved] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Andriy Redko (Jira)
• 2026/08/24 [jira] [Resolved] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• 2026/08/21 [jira] [Updated] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• 2026/08/21 [jira] [Closed] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire Colm O hEigeartaigh (Jira)
• 2026/08/21 [jira] [Created] (CXF-9244) Remove Hawk functionality Colm O hEigeartaigh (Jira)
• 2026/08/21 [jira] [Updated] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• 2026/08/21 [jira] [Assigned] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Colm O hEigeartaigh (Jira)
• 2026/08/18 [jira] [Resolved] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• 2026/08/18 [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• 2026/08/15 [jira] [Created] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries Guanping Zhang (Jira)
• 2026/08/15 [jira] [Created] (CXF-9242) JwtAccessTokenValidator accepts absent `typ` header; OIDC IdP issues id_tokens without `typ`, enabling token confusion in misconfigured RS Guanping Zhang (Jira)
• 2026/08/14 [jira] [Assigned] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• 2026/08/14 [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• 2026/08/13 [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
• 2026/08/13 [jira] [Assigned] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Andriy Redko (Jira)
• 2026/08/13 [jira] [Updated] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Andriy Redko (Jira)
• 2026/08/13 [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( Valentino Porta (Jira)
• 2026/08/13 [jira] [Created] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow Guanping Zhang (Jira)
• 2026/08/13 [jira] [Assigned] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Updated] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Commented] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Updated] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Assigned] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Resolved] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Assigned] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap Colm O hEigeartaigh (Jira)
• 2026/08/13 [jira] [Resolved] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• 2026/08/12 [jira] [Updated] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• 2026/08/12 [jira] [Updated] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• 2026/08/12 [jira] [Assigned] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Colm O hEigeartaigh (Jira)
• 2026/08/10 [jira] [Created] (CXF-9238) AbstractAccessTokenValidator validation cache evicts ALL entries via clear() on overflow — replace with LRU to avoid cache-thrash Guanping Zhang (Jira)
• 2026/08/10 [jira] [Created] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses Guanping Zhang (Jira)
• 2026/08/10 [jira] [Created] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap Guanping Zhang (Jira)
• 2026/08/09 [jira] [Commented] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Andriy Redko (Jira)
• 2026/08/09 [jira] [Updated] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire Guanping Zhang (Jira)
• 2026/08/09 [jira] [Created] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted Guanping Zhang (Jira)
• 2026/08/09 [jira] [Created] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire Guanping Zhang (Jira)
• 2026/08/09 [jira] [Commented] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted Guanping Zhang (Jira)
• 2026/08/07 [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• 2026/08/06 [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• 2026/08/06 [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• 2026/08/05 [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• 2026/08/05 [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Freeman Yue Fang (Jira)
• 2026/08/05 [jira] [Resolved] (CXF-9234) Concurrent DynamicClientFactory.createClient for the same WSDL url corrupts the cached schema DOM and spins forever at 100% CPU Freeman Yue Fang (Jira)
• 2026/08/05 [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• 2026/08/04 [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)
• 2026/08/04 [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request Neena Jacob (Jira)

• Earlier messages