CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security

Apache CXF released security updates addressing CVE-2026-100227, a moderate severity flaw in the JAX-RS XML Security module where XML Signature interceptors fail to ensure XML passed to applications is covered by the signature. The vulnerability affects CXF versions 3.6.13 and earlier, 4.0.0 through 4.1.8, and 4.2.0 through 4.2.3.

Why it matters: Organizations using Apache CXF for XML web services should update immediately to prevent attackers from submitting unsigned or improperly signed XML payloads that could bypass authentication or integrity checks.

Source published

2026-10-09 10:25 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC