CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security
Apache CXF JAX-RS XML Security failed to bind signed XML, allowing signature-wrapping attacks.
Apache CXF's JAX-RS XML Security module improperly verified cryptographic signatures, allowing XML signature wrapping. CVE-2026-100227 affects XmlSigInHandler, XmlSigInInterceptor, and the streaming XmlSecInInterceptor, which did not ensure that XML passed to the application was covered by the signature. Apache rates the issue moderate. Affected versions are CXF before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4, with no exploitation reported.
- JAX-RS interceptors did not ensure application XML was signature-covered.
- XmlSigInHandler, XmlSigInInterceptor, and XmlSecInInterceptor are affected.
- Apache rates the XML signature-wrapping flaw moderate.
- Patched in CXF 3.6.13, 4.1.9, and 4.2.4.
- CVEs
- CVE-2026-100227
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100227 | XML Signature Wrapping in Apache CXF JAX-RS XML Security | 7.5 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: moderate Affected versions: - Apache CXF 4. 2. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.