# CVE-2026-50634: Apache CXF signature verification bypass in JwsJsonContainerRequestFilter

Source: https://junglewise.ai/threats/cve-2026-50634-apache-cxf-signature-verification-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-50634 · Severity: medium · CVSS 6.5 · Published 2026-06-12

Apache CXF is a web services framework used to build SOAP and REST web services. A vulnerability in its JSON Web Signature filter allows attackers to bypass signature validation on HTTP metadata (such as Content-Type headers) by exploiting an unvalidated first signature entry. This could allow an attacker to inject malicious metadata that causes the application to process requests in unintended ways, potentially leading to data exposure or integrity violations.

Technologies: [Apache Software Foundation CXF](https://junglewise.ai/threats/technologies/cxf). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-50634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50634 being exploited in the wild.

**How severe is CVE-2026-50634?** Medium severity, with a CVSS score of 6.5, published 12 June 2026.

**Which products and versions are affected?** Apache Software Foundation CXF 4.2.0 to 4.2.1, all versions before 4.1.7; org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (Maven) ECOSYSTEM:introduced=4.2.0,fixed=4.2.2.

**Is there a fix for CVE-2026-50634?** Yes. org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (Maven): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50634 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-50634?** Check whether you run Apache Software Foundation CXF or org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (Maven): upgrade to 4.2.2 or later

  ```sh
  # set org.apache.cxf:cxf-rt-rs-security-jose-jaxrs to 4.2.2 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is an improper cryptographic signature verification flaw (CWE-347) in the JwsJsonContainerRequestFilter component of Apache CXF. The filter processes JSON Web Signature (JWS) formatted requests but fails to properly validate all signature entries, trusting metadata from an unvalidated first signature entry. An attacker can send a network-based JWS request with multiple signature entries, causing the filter to accept metadata (Content-Type, protected headers) that was not actually signed by a trusted key. This can lead to bypass of signature validation assumptions, potentially steering downstream JAX-RS entity parsing or causing inconsistencies in signed-header validation logic. No authentication or user interaction is required. Patches are available in Apache CXF versions 4.2.2 (for 4.2.0+) and 4.1.7 (for earlier branches).

## Affected products

- Apache CXF cxf-rt-rs-security-jose-jaxrs 4.2.0 to 4.2.1, all versions before 4.1.7

## Identifiers

- CVE-2026-50634
- GHSA-33j8-j763-4fv5

## Timeline

- 2026-06-11: disclosed: CVE-2026-50634 disclosed on oss-security mailing list
- 2026-06-12: patched: Fixes available in Apache CXF 4.2.2 and 4.1.7
- 2026-06-12: advisory: GitHub Advisory GHSA-33j8-j763-4fv5 published

## References

- [https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p](https://lists.apache.org/thread/9nfwh9d3m4kznxrk1mz98hl0jml18k0p)
- [http://www.openwall.com/lists/oss-security/2026/06/11/11](http://www.openwall.com/lists/oss-security/2026/06/11/11)

## Related threats

- [Apache CXF denial of service via attachment headers](https://junglewise.ai/threats/cve-2026-50645-apache-cxf-denial-of-service-via-attachment-headers)
- [Apache CXF race condition in AbstractOAuthDataProvider](https://junglewise.ai/threats/cve-2026-50631-apache-cxf-race-condition-in-abstractoauthdataprovider)
- [Apache CXF inverted IP binding check in OAuthRequestFilter](https://junglewise.ai/threats/cve-2026-50628-apache-cxf-inverted-ip-binding-check-in-oauthrequestfilter)
- [Apache CXF missing JWT Audience validation in JwtAccessTokenValidator](https://junglewise.ai/threats/cve-2026-50627-apache-cxf-missing-jwt-audience-validation-in)
- [Apache CXF authentication bypass in OAuth2 TokenIntrospectionService](https://junglewise.ai/threats/cve-2026-50623-apache-cxf-authentication-bypass-in-oauth2)