CVE-2026-50634: 
Apache CXF vulnerability analysis and mitigation

CVE-2026-50634 is an improper cryptographic signature verification vulnerability in Apache CXF's JwsJsonContainerRequestFilter component, formally titled "WS JSON request filter trusts metadata from an unvalidated first signature entry." It affects Apache CXF versions before 4.1.7 and versions 4.2.0 through 4.2.2 (exclusive), specifically the cxf-rt-rs-security-jose-jaxrs artifact. The vulnerability was disclosed on June 11, 2026, by reporter Mitchell Benjamin of Revamp Studio, with patches released the same day (Apache Advisory, oss-security). It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). The JwsJsonContainerRequestFilter in Apache CXF processes JSON Web Signature (JWS) requests but incorrectly trusts metadata — such as Content-Type headers or other protected HTTP headers — sourced from the first signature entry without verifying that this entry was actually authenticated by the accepted signature (oss-security). An unauthenticated remote attacker can craft a JWS JSON request containing a malicious first signature entry with manipulated metadata, causing CXF to process that unverified metadata as if it were cryptographically authenticated. This can steer downstream JAX-RS entity parsing or signed-header consistency checks in unintended ways (GitHub Advisory). The attack requires no privileges and no user interaction, making it exploitable over the network with low complexity.

Successful exploitation allows an unauthenticated network attacker to bypass the application's assumption that Content-Type or protected HTTP-header metadata was cryptographically verified, resulting in low-level confidentiality and integrity impacts with no availability impact (GitHub Advisory). Concretely, an attacker could manipulate how the server parses incoming request bodies or how signed-header consistency checks are evaluated, potentially leading to content-type confusion attacks, unauthorized data access, or bypassing security controls that rely on header integrity (Apache Advisory). Applications using JwsJsonContainerRequestFilter for request authentication are most at risk, particularly those that make trust decisions based on the assumed integrity of Content-Type or other protected headers.

1. Identify target: Locate a service running Apache CXF (versions before 4.1.7 or 4.2.0–4.2.1) that uses JwsJsonContainerRequestFilter for JWS JSON request validation, typically exposed via a JAX-RS REST endpoint.
2. Craft malicious JWS JSON payload: Construct a JWS JSON serialization request with multiple signature entries. Place a malicious first signature entry containing manipulated Content-Type or protected HTTP-header metadata that was not covered by the accepted (valid) signature.
3. Submit the request: Send the crafted HTTP request to the target endpoint. CXF's JwsJsonContainerRequestFilter processes the metadata from the unvalidated first signature entry as if it were authenticated.
4. Trigger downstream impact: The manipulated metadata steers JAX-RS entity parsing (e.g., causing the server to parse the body as a different content type) or bypasses signed-header consistency checks, potentially enabling content-type confusion or security control bypass (oss-security, GitHub Advisory).

• Network: Unexpected HTTP requests to JAX-RS endpoints with JWS JSON payloads (application/jose+json or similar content types) containing multiple signature entries from untrusted or unknown sources.
• Logs: Apache CXF application logs showing unusual Content-Type negotiation or entity parsing errors on endpoints protected by JwsJsonContainerRequestFilter; requests where the declared content type does not match expected application behavior.
• Application Behavior: Downstream processing anomalies such as unexpected deserialization of request bodies, signed-header validation failures, or JAX-RS entity parsing errors that correlate with inbound JWS JSON requests.

Users should upgrade Apache CXF to version 4.1.7 (for the 4.1.x branch) or 4.2.2 (for the 4.2.x branch), which contain the fix for this issue (Apache Advisory, oss-security). No configuration-based workaround has been officially documented; upgrading is the recommended and only confirmed remediation. As an interim measure, organizations should review applications relying on JwsJsonContainerRequestFilter and consider implementing additional server-side validation of Content-Type and protected headers independent of the JWS signature processing layer.

The vulnerability was reported by Mitchell Benjamin of Revamp Studio and disclosed via the Apache security mailing list and oss-security on June 11, 2026 (oss-security). Security aggregators including SecurityOnline.info and Tenable covered the advisory shortly after disclosure (Feedly). Community reaction has been measured, consistent with a medium-severity vulnerability with no active exploitation; a brief mention appeared on Bluesky infosec feeds within hours of disclosure.