CVE-2026-50634

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50634", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-05T11:26:05.858Z", "datePublished": "2026-06-12T09:05:53.768Z", "dateUpdated": "2026-08-07T12:43:39.789Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.cxf:cxf-rt-rs-security-jose-jaxrs", "product": "Apache CXF", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.2.2", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThan": "4.1.7", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mitchell Benjamin / Revamp Studio."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Apache CXF's&nbsp;JwsJsonContainerRequestFilter can be exploited to cause&nbsp;CXF to process metadata that was not authenticated by the accepted signature.&nbsp;This can bypass the application's assumption<br>\nthat accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.<br><br>"}], "value": "A vulnerability in Apache CXF's\u00a0JwsJsonContainerRequestFilter can be exploited to cause\u00a0CXF to process metadata that was not authenticated by the accepted signature.\u00a0This can bypass the application's assumption\n\nthat accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-07T12:43:39.789Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/11/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-12T09:28:13.663Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T15:09:10.039475Z", "id": "CVE-2026-50634", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:10:21.356Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/11/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-12T09:28:13.663Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-50634", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T15:09:10.039475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:09:03.943Z"}}], "cna": {"title": "Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mitchell Benjamin / Revamp Studio."}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.2", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.7", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.12", "versionType": "semver"}], "packageName": "org.apache.cxf:cxf-rt-rs-security-jose-jaxrs", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Apache CXF's\u00a0JwsJsonContainerRequestFilter can be exploited to cause\u00a0CXF to process metadata that was not authenticated by the accepted signature.\u00a0This can bypass the application's assumption\n\nthat accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Apache CXF's&nbsp;JwsJsonContainerRequestFilter can be exploited to cause&nbsp;CXF to process metadata that was not authenticated by the accepted signature.&nbsp;This can bypass the application's assumption<br>\nthat accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-07T12:43:39.789Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50634", "state": "PUBLISHED", "dateUpdated": "2026-08-07T12:43:39.789Z", "dateReserved": "2026-06-05T11:26:05.858Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-06-12T09:05:53.768Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.cxf:cxf-rt-rs-security-jose-jaxrs", "product": "Apache CXF", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.2.2", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThan": "4.1.7", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "09753EF1-BB56-4238-8ED7-609E2AB5EB05", "versionEndExcluding": "3.6.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1F06BBE-6F15-4567-A427-204A602A9714", "versionEndExcluding": "4.1.7", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1BF06FC-96AD-4663-9959-1B1493D4A2A0", "versionEndExcluding": "4.2.2", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Apache CXF's\u00a0JwsJsonContainerRequestFilter can be exploited to cause\u00a0CXF to process metadata that was not authenticated by the accepted signature.\u00a0This can bypass the application's assumption\n\nthat accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue."}, {"lang": "es", "value": "Una vulnerabilidad en el JwsJsonContainerRequestFilter de Apache CXF puede ser explotada para hacer que CXF procese metadatos que no fueron autenticados por la firma aceptada. Esto puede eludir la suposici\u00f3n de la aplicaci\u00f3n de que los metadatos de \u2019Content-Type\u2019 aceptados o de encabezado HTTP protegido proven\u00edan de una entrada de firma verificada, y puede dirigir el an\u00e1lisis de entidades JAX-RS posterior o las comprobaciones de coherencia de encabezados firmados. Se recomienda a los usuarios actualizar a las versiones 4.2.2 o 4.1.7, que solucionan este problema."}], "id": "CVE-2026-50634", "lastModified": "2026-11-05T15:54:15.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50634", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T15:09:10.039475Z", "version": "2.0.3"}}]}, "published": "2026-06-12T10:16:23.413", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/06/11/11"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.1.7)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache CXF", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "cxf", "vendor": "apache"}], "created": "2026-06-12T11:00:05.504614+00:00", "updated": "2026-08-07T13:30:03.373402+00:00", "vendors": ["apache", "apache$PRODUCT$cxf"]}