CVE-2026-100227CWE-362

CVE-2026-100227

High · published October 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.

Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-10-09T15:17Z
Affected products (3)
ProductVersionsFixed in
apache/cxf< 3.6.133.6.13
apache/cxf≥ 4.0.0, < 4.1.94.1.9
apache/cxf≥ 4.2.0, < 4.2.44.2.4
References (2)
https://lists.apache.org/thread.html/pst2oopnwt2rwhvkvmt5gdgwn36kq05m · [email protected]http://www.openwall.com/lists/oss-security/2026/10/09/11 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 11 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 09 OCT 10:19Z
    Apache CXF: XML Signature wrapping in JAX-RS XML Security
    cvelistv5
  • 09 OCT 10:19Z
    Apache CXF: XML Signature wrapping in JAX-RS XML Security
    cvelistv5