Apache CXF End of Life - Dates and Lifecycle
Apache CXF is an open-source services framework for building web services using JAX-WS and JAX-RS, supporting protocols like SOAP, XML/HTTP, and RESTful HTTP.
Last updated 29 July 2026
5
Versions tracked
2
At EOL
3
Supported
All versions
| Version | Released | Security Support | Latest |
|---|---|---|---|
|
4.2
|
16 Feb 2026 | — |
4.2.2
10 Jun 2026
|
|
4.1
|
13 Dec 2024 | — |
4.1.7
10 Jun 2026
|
|
3.6
|
08 May 2023 | — |
3.6.11
20 May 2026
|
|
4.0
|
22 Dec 2022 |
16 Feb 2026
Ended 5 months, 1 week ago
|
4.0.11
16 Feb 2026
|
|
3.5
|
22 Dec 2021 |
06 Mar 2025
Ended 1 year, 4 months ago
|
3.5.11
06 Mar 2025
|
About Apache CXF
Apache CXF is an open-source services framework from the Apache Software Foundation for building and consuming web services using frontend programming APIs like JAX-WS and JAX-RS. It supports a range of protocols, including SOAP, XML/HTTP, RESTful HTTP, and CORBA, and can run over transports like HTTP, JMS, or JBI, making it a common choice for enterprise Java service integration.
Apache CXF Lifecycle Explained
Unlike products with a single active release line, CXF typically maintains several branches in parallel and retires them by explicit announcement rather than a fixed calendar schedule. As of mid-2026, that means 4.1.x and 4.2.x are both actively patched at the same time, while 3.6.x continues to receive updates on a slower cadence. Older lines are wound down formally: the CXF team explicitly announced 3.5.11 as "the last release of the CXF 3.5.x series," and separately confirmed 4.0.11 as the last planned release for the 4.0.x line.
Namespace and JDK Baseline by Version
The single most important compatibility fact across CXF's version history is the shift from Java's old javax.* package namespace to the newer jakarta.* namespace, alongside a climbing minimum JDK requirement. This is not a minor detail, moving between namespaces is a breaking change that touches imports throughout a codebase, not just a version bump.
| CXF Line | Namespace | Jakarta EE Level | Minimum JDK |
|---|---|---|---|
| 4.2.x | jakarta.* | Jakarta EE 11 | 17 |
| 4.1.x | jakarta.* | Jakarta EE 10 | 17 |
| 4.0.x | jakarta.* | Jakarta EE 9.1 | 11 |
| 3.6.x | javax.* | Jakarta EE 8 | 11 |
| 3.5.x | javax.* | Jakarta EE 8 | 8 |
Practically, this means the 3.6.x line exists specifically for teams that need a modern JDK baseline and ongoing patches but can't yet migrate their code off the older javax.* namespace, while the 4.x lines are exclusively for teams already on Jakarta EE. Choosing which line to upgrade to isn't just about version numbers, it depends on whether your application and its other dependencies have made the jakarta transition yet.
Frequently Asked Questions
What is Apache CXF?
Apache CXF is an open-source framework for building and consuming web services in Java, supporting standards like JAX-WS and JAX-RS along with protocols including SOAP and REST. It's maintained by the Apache Software Foundation and widely used for enterprise service integration.
What is the latest version of Apache CXF?
Apache CXF 4.2.2, released in June 2026, is the current latest release. It's part of the 4.2.x line, which added support for Jakarta EE 11.
Is Apache CXF 3.x end of life?
It depends on which 3.x line. CXF 3.5.x is fully end of life, with 3.5.11 explicitly declared its final release. Earlier 3.x lines (3.0 through 3.4) have also each reached end of life in turn, though this site doesn't yet have verified dates for those older releases. CXF 3.6.x, however, is still receiving patches and hasn't been formally retired, it exists specifically to support teams still on the older javax namespace with a modern JDK baseline.
What is the difference between JAXB and CXF?
They solve different problems. JAXB (Jakarta XML Binding) is a specification for converting Java objects to and from XML. CXF is a full services framework that uses JAXB internally, among other components, to handle the XML side of building SOAP and REST web services. You wouldn't choose between them, CXF depends on JAXB-style binding as one piece of a much larger toolkit.
What are my options if I'm running an EOL CXF version?
The most direct path is upgrading to a currently maintained line, 3.6.x if you're not ready to move off the javax namespace, or 4.1.x/4.2.x if you are. Because the jakarta namespace transition is a breaking change, this is worth treating as a real migration project rather than a routine dependency bump. If neither is immediately feasible, some Java application server vendors maintain their own patched CXF builds independent of the Apache project's official release line, which can serve as a stopgap while a longer-term upgrade is planned.