{"api_version":"1","generated_at":"2026-10-21T15:35:21+00:00","cve":"CVE-2026-100227","urls":{"html":"https://cve.report/CVE-2026-100227","api":"https://cve.report/api/cve/CVE-2026-100227.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-100227","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100227"},"summary":{"title":"Apache CXF: XML Signature wrapping in JAX-RS XML Security","description":"Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-10-09 11:17:01","updated_at":"2026-10-16 18:09:15"},"problem_types":["CWE-362","CWE-362 CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/11","name":"http://www.openwall.com/lists/oss-security/2026/10/09/11","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.apache.org/thread.html/pst2oopnwt2rwhvkvmt5gdgwn36kq05m","name":"https://lists.apache.org/thread.html/pst2oopnwt2rwhvkvmt5gdgwn36kq05m","refsource":"security@apache.org","tags":["Issue Tracking","Vendor Advisory","Mailing List"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100227","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100227","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache CXF","version":"affected 4.2.0 4.2.4 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache CXF","version":"affected 4.0.0 4.1.9 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache CXF","version":"affected 3.6.13 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"This issue was found using Claude agents to study the security of open-source projects and independently by Guanping Zhang","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"100227","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"cxf","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"100227","cve":"CVE-2026-100227","epss":"0.001730000","percentile":"0.062360000","score_date":"2026-10-11","updated_at":"2026-10-12 00:13:21"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-10-09T11:07:51.197Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/11"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-100227","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-15T17:41:39.286657Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-15T17:42:03.056Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.cxf:cxf-rt-rs-security-xml","packageURL":"pkg:maven/org.apache.cxf/cxf-rt-rs-security-xml","product":"Apache CXF","vendor":"Apache Software Foundation","versions":[{"lessThan":"4.2.4","status":"affected","version":"4.2.0","versionType":"semver"},{"lessThan":"4.1.9","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"3.6.13","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"This issue was found using Claude agents to study the security of open-source projects and independently by Guanping Zhang"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.<br>Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue."}],"value":"Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"dateUpdated":"2026-10-09T10:19:40.756Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/pst2oopnwt2rwhvkvmt5gdgwn36kq05m"}],"source":{"discovery":"UNKNOWN"},"title":"Apache CXF: XML Signature wrapping in JAX-RS XML Security","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-100227","datePublished":"2026-10-09T10:19:40.756Z","dateReserved":"2026-09-25T15:15:43.370Z","dateUpdated":"2026-10-15T17:42:03.056Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-09 11:17:01","lastModifiedDate":"2026-10-16 18:09:15","problem_types":["CWE-362","CWE-362 CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T17:41:39.286657Z","id":"CVE-2026-100227","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*","versionEndExcluding":"3.6.13","matchCriteriaId":"3CD2E496-3098-41C3-94A5-26A788711F15"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.9","matchCriteriaId":"989264A3-989E-4ED7-BA9A-74F6589B0282"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.4","matchCriteriaId":"EA32F98B-64AC-4E85-BD29-6287A9883A00"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"100227","Ordinal":"1","Title":"Apache CXF: XML Signature wrapping in JAX-RS XML Security","CVE":"CVE-2026-100227","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"100227","Ordinal":"1","NoteData":"Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","Type":"Description","Title":"Apache CXF: XML Signature wrapping in JAX-RS XML Security"}]}}}