CVE-2026-50634

EUVD-2026-36402

12.06.2026, 10:16

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption

that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 20%

Affected Products (NVD)

Vendor	Product	Version
apache	cxf	𝑥 < 4.1.7
apache	cxf	4.2.0 ≤ 𝑥 < 4.2.2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-347 - Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.

Vulnerability Media Exposure

[GERMAN] Apache CXF: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um Sicherheitsvorkehrungen zu umgehen, XML-External-Entity-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
Published: 2026-06-11T22:00:00+00:00

References

https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p

http://www.openwall.com/lists/oss-security/2026/06/11/11