CVE-2026-50634

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-50634

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50634.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-50634

Published

2026-06-12T09:05:53.768Z

Modified

2026-07-15T01:49:07.077406561Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

Details

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption

that accepted Content-Type or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Database specific

{
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50634.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.2.0"
                },
                {
                    "fixed": "4.2.2"
                },
                {
                    "fixed": "4.1.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "apache"
}

References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type

GIT

Repo

https://github.com/apache/cxf

Events

Introduced

Fixed

82e9f60f994a7fad2d89f3c94e9090a4a8990c70

Introduced

04ccbfd709eef8f4af53d6237514fbe9db7ea81f

Fixed

d2b2776cd44a8d2f391194d90f50ce7b3d61a1f6

Database specific

{
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1.7"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

cxf-2.*

cxf-2.1

cxf-2.1.2

cxf-2.2

cxf-2.2.1

cxf-2.2.2

cxf-2.3.0

cxf-2.4.0

cxf-2.5.0

cxf-2.5.1

cxf-2.6.0

cxf-2.6.1

cxf-2.7.0

cxf-2.7.1

cxf-2.7.2

cxf-3.*

cxf-3.0.0

cxf-3.0.0-milestone2

cxf-3.1.0

cxf-3.1.1

cxf-3.1.2

cxf-3.1.3

cxf-3.1.4

cxf-3.2.0

cxf-3.2.1

cxf-3.2.2

cxf-3.2.3

cxf-3.2.4

cxf-3.2.5

cxf-3.3.0

cxf-3.3.1

cxf-3.3.2

cxf-3.3.3

cxf-3.4.0

cxf-3.4.1

cxf-3.5.0

cxf-4.*

cxf-4.0.0

cxf-4.0.1

cxf-4.0.2

cxf-4.0.3

cxf-4.0.4

cxf-4.1.0

cxf-4.1.1

cxf-4.1.2

cxf-4.1.3

cxf-4.1.4

cxf-4.1.5

cxf-4.1.6

cxf-4.2.0

cxf-4.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50634.json"