https://seclists.org/oss-sec/2026/q4/113: CVE-2026-100227: Apache CXF: XML Signatuwrapping in JAX-RS XML Security

Q: Which deployments are exposed to this issue?

Deployments using Apache CXF's JAX-RS XML Security module with the XML Signature inbound interceptors are affected if they run CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, or a release before 3.6.13.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs a document signed by a key trusted by the affected application. They can wrap that signed document in unsigned XML content that the application may then treat as signed.

Q: Are applications that use XML signatures but do not use the affected JAX-RS interceptors impacted?

The issue is described specifically in the JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor, and the streaming XmlSecInInterceptor. The provided information does not identify other XML signature components as affected.

Q: What is the remediation?

Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. These releases fix the signature-coverage verification issue.

Published Oct 9, 2026

Updated

Affected Software

1 affected component

Apache CXF>=4.2.0<4.2.4, >=4.0.0<4.1.9, <3.6.13

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Apache CXF's JAX-RS XML Security module with the XML Signature inbound interceptors are affected if they run CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, or a release before 3.6.13.

What does an attacker need to exploit the vulnerability?

The attacker needs a document signed by a key trusted by the affected application. They can wrap that signed document in unsigned XML content that the application may then treat as signed.

Are applications that use XML signatures but do not use the affected JAX-RS interceptors impacted?

The issue is described specifically in the JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor, and the streaming XmlSecInInterceptor. The provided information does not identify other XML signature components as affected.

What is the remediation?

Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. These releases fix the signature-coverage verification issue.