GHSA-33j8-j763-4fv5: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

Q: Which deployments are exposed to this issue?

Deployments using Apache CXF's JwsJsonContainerRequestFilter are exposed if application behavior relies on Content-Type or protected HTTP-header metadata being authenticated by the signature that CXF accepts.

Q: What does an attacker need to exploit the vulnerability?

The issue is remotely exploitable with low complexity, requires no privileges or user interaction, and involves supplying a WS JSON request whose first signature entry provides metadata that is not authenticated by the accepted signature.

Q: What should teams do if they are affected?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions fix the issue.

Published Jun 12, 2026

Updated

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption

that accepted Content-Type or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Affected Software

1 affected component

Apache CXF<4.2.2, <4.1.7, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·09:05 AM

Data Sourced

via OSV·09:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Apache CXF's JwsJsonContainerRequestFilter are exposed if application behavior relies on Content-Type or protected HTTP-header metadata being authenticated by the signature that CXF accepts.

What does an attacker need to exploit the vulnerability?

The issue is remotely exploitable with low complexity, requires no privileges or user interaction, and involves supplying a WS JSON request whose first signature entry provides metadata that is not authenticated by the accepted signature.

What should teams do if they are affected?

Upgrade Apache CXF to version 4.2.2, 4.1.7, or 3.6.12. These versions fix the issue.

GHSA-33j8-j763-4fv5: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should teams do if they are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What should teams do if they are affected?