CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security
Apache CXF JAX-RS XML Security failed to bind signed XML, allowing signature-wrapping attacks.
50
Vulnerability3 · 2 reads
CVE-2026-100227
XML Signature Wrapping in Apache CXF JAX-RS XML Security
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF's JAX-RS XML Security module fails to verify that the XML handed to the application is actually covered by a valid signature. The interceptors XmlSigInHandler, XmlSigInInterceptor, and the streaming XmlSecInInterceptor accept a document that contains any content signed by a trusted key, so an attacker can wrap that signed fragment in unsigned XML that the application then treats as signed. This is an XML signature wrapping flaw: integrity and authenticity checks can be bypassed for the unsigned wrapper even though a trusted signature is present. It affects deployments that use those JAX-RS XML Signature interceptors on CXF versions before the fixes in 4.2.4, 4.1.9, and 3.6.13. There is no known public proof of concept and no report of exploitation in the wild, and the issue is not listed in CISA KEV.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, identify services that use XmlSigInHandler, XmlSigInInterceptor, or the streaming XmlSecInInterceptor and do not treat inbound XML as fully signed merely because a trusted signature is present.
| Product | Affected |
|---|---|
| Apache CXF JAX-RS XML Security (XmlSigInHandler, XmlSigInInterceptor, XmlSecInInterceptor) | Releases fixed in 4.2.4, 4.1.9, and 3.6.13; earlier versions on those lines are affected |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.