CVE-2026-50634

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption

that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12

References

https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0pMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/11/11Mailing List, Third Party Advisory

Timeline

Published: Jun 12, 2026
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-506358.8LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHost CVE-2026-506368.8The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninv CVE-2026-506378.2Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions CVE-2026-506389.1Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensi CVE-2026-506396.5Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensio CVE-2026-50648.5Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow fo CVE-2026-506417.1Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, us CVE-2026-506424.8diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SG CVE-2026-506435.18cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-c CVE-2026-506448.6SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL com CVE-2026-506457.5There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead CVE-2026-506467.8Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.