Vulnerability · Published Jun 12, 2026 · Assigned by apache
CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Medium 6.5
In plain English
A medium-severity security flaw in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-rs-security-jose-jaxrs | 4.2.2 | GHSA-33j8-j763-4fv5 |
| Maven | org.apache.cxf:cxf-rt-rs-security-jose-jaxrs | 4.1.7 | GHSA-33j8-j763-4fv5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – before 4.2.24.0.0 – before 4.1.70 – before 3.6.12 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N