Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

TRUNG BÌNH 6.5CVE-2026-50634 · GHSA-33j8-j763-4fv5 · Công bố 12/06/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-50634 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng org.apache.cxf:cxf-rt-rs-security-jose-jaxrs, cxf (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.28%, cao hơn 20.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.2.2, 4.1.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.cxf:cxf-rt-rs-security-jose-jaxrs Maven	`≥ 4.2.0, < 4.2.2< 4.1.7`	`4.2.24.1.7`
cxf apache	`≥ 4.2.0, < 4.2.2< 4.1.7`	`4.2.24.1.7`

Mô tả

that accepted Content-Type or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Mô tả của NVD

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.