Improper Verification of Cryptographic Signature in Apache CXF

CVE-2026-100227

What is CVE-2026-100227?

A vulnerability exists within Apache CXF's JAX-RS XML Security module that fails to properly verify cryptographic signatures. Specifically, the XML Signature interceptors such as XmlSigInHandler, XmlSigInInterceptor, and streaming XmlSecInInterceptor do not ensure that the incoming XML data is appropriately signed. As a result, an attacker can manipulate signed documents, allowing unsigned content to be processed as though it were validly signed. To mitigate this risk, it is crucial for users to upgrade to supported versions, specifically 4.2.4, 4.1.9, or 3.6.13, where this issue has been rectified.

References