diff --git a/bom/runtime/pom.xml b/bom/runtime/pom.xml
index 695d24ab9..cedf86621 100644
--- a/bom/runtime/pom.xml
+++ b/bom/runtime/pom.xml
@@ -175,6 +175,12 @@
       <artifactId>cxf-rt-rs-sse</artifactId>
       <version>${cxf.version}</version>
     </dependency>
+    <!-- needed as long as cxf3 requires wstx 6.x -->
+    <dependency>
+      <groupId>com.fasterxml.woodstox</groupId>
+      <artifactId>woodstox-core</artifactId>
+      <version>6.6.2</version>
+    </dependency>
 
     <!-- JAX-RS 2.1 API with contract -->
     <dependency>
diff --git a/features/karaf/openhab-tp/src/main/feature/feature.xml b/features/karaf/openhab-tp/src/main/feature/feature.xml
index eecab0328..113b9339b 100644
--- a/features/karaf/openhab-tp/src/main/feature/feature.xml
+++ b/features/karaf/openhab-tp/src/main/feature/feature.xml
@@ -117,7 +117,7 @@
 	<feature name="openhab.tp-cxf" description="Apache CXF" version="${project.version}">
 		<capability>openhab.tp;feature=cxf;version=3.6.4</capability>
 		<feature dependency="true">openhab.tp-jaxws</feature>
-		<bundle dependency="true">mvn:com.fasterxml.woodstox/woodstox-core/6.5.1</bundle>
+		<bundle dependency="true">mvn:com.fasterxml.woodstox/woodstox-core/6.6.2</bundle>
 		<bundle dependency="true">mvn:jakarta.jws/jakarta.jws-api/2.1.0</bundle>
 		<bundle dependency="true">mvn:jakarta.xml.ws/jakarta.xml.ws-api/2.3.3</bundle>
 		<bundle dependency="true">mvn:javax.servlet/javax.servlet-api/3.1.0</bundle>