CVE-2026-50634 — Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

Description (CNA)

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache CXF	affected 4.2.0 before 4.2.2; affected 4.0.0 before 4.1.7; affected 0 before 3.6.12

CWE

CWE-347

References

https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/11/11

CISA-ADP

No English description supplied.

No references supplied.