Critical vulnerabilities in dependency (Apache CXF) #164

Activity

1. StyopinN commented on Jan 12, 2023

   

   StyopinN

   on Jan 12, 2023

   Author

   More actions

   I have started solution, but have a problem with generating code for client: jaxws/bindings.xml rules should change package name, but they don't
2. astharora commented on Feb 13, 2024

   

   astharora

   on Feb 13, 2024

   More actions

   Is anyone working on this?
3. bertysentry commented on Aug 11, 2026

   

   bertysentry

   on Aug 11, 2026

   More actions

   Hi! 👋

   If you're looking for an actively maintained alternative to winrm4j, we maintain winrm-java, another WinRM (light) client for Java and its documentation with zero runtime dependencies, designed to be easy to migrate to from winrm4j:

   	winrm4j 0.12.x	winrm-java 2.1
   Dependencies	Apache CXF + HttpClient + JAXB (dozens of jars)	None (single ~300 kB jar)
   Java	8 (needs manual JAX-WS/JAXB additions on 11+)	11+ (works out of the box on current JDKs)
   Commands & PowerShell	executeCommand / executePs	command(...) / powerShell(...) — no script size limit, no escaping
   WQL / WMI queries	—	✔ (paged, streamable)
   File transfer	—	✔ (through the WinRM channel itself, no SMB)
   Live output, stdin, Process-style streaming	partial (Writer tail)	✔
   Maintenance	last commit 2023	active

   Migration is pretty straightforward:

   try (WinRMClient client = WinRMClient.builder("server01").credentials("DOMAIN\\user", password).build()) {
       CommandResult result = client.powerShell("Get-Service | Where-Object Status -eq 'Running'").execute();
       System.out.println(result.stdout());
   }

   There's a dedicated migration guide mapping every WinRmTool / WinRmClientBuilder option to its equivalent, including the behavioral differences to watch for

   Maven coordinates: org.metricshub:winrm-java:2.1.00, and license is Apache-2.0, like winrm4j.