CVE-2026-100227

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13

Description Improper verification of cryptographic signatures in the JAX-RS XML Security module allows for XML Signature wrapping. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) fail to ensure that the XML passed to the application is fully covered by the signature. This allows an attacker to wrap a document signed by a trusted key within unsigned content, which the application then incorrectly treats as signed.

Recommendations Upgrade to version 4.2.4. Upgrade to version 4.1.9. Upgrade to version 3.6.13.