PT-2026-48853 · Apache · Apache Cxf

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-50634

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7

Description An issue in the JwsJsonContainerRequestFilter allows the processing of metadata that was not authenticated by the accepted signature. This can bypass assumptions that protected HTTP-header metadata or the Content-Type originated from a verified signature entry, potentially influencing signed-header consistency checks or downstream JAX-RS entity parsing.

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.1.7.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-50634

Affected Products

Apache Cxf

References · 4

• https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50634 · Security Note
• http://openwall.com/lists/oss-security/2026/06/11/11 · Note
• https://twitter.com/VulmonFeeds/status/2065383822254886914 · Twitter Post