PUBLISHED
2026-06-12 10:16
MODIFIED
2026-06-12 10:16
EPSS (Prob. Exploit)
0.28%
Top 79.9%
> DESCRIPTION
A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption
that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-347: Improper Verification of Cryptographic Signature - The product does not verify, or incorrectly verifies, the cryptographic signature for data.
> GITHUB SECURITY ADVISORY
GHSA-33j8-j763-4fv5
MODERATE
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
AFFECTED PACKAGES:
MAVEN / org.apache.cxf:cxf-rt-rs-security-jose-jaxrs
< 4.1.7
Fixed in: 4.1.7
MAVEN / org.apache.cxf:cxf-rt-rs-security-jose-jaxrs
>= 4.2.0, < 4.2.2
Fixed in: 4.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
AFFECTED PACKAGES:
Unknown / Unknown
48 versions affected
ALIASES:
GHSA-33j8-j763-4fv5
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/06/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-347: Improper Verification of Cryptographic Signature - The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Total des modifications: 1
Dernière mise à jour: 4 months ago