Acceptance of Extraneous Untrusted Data With Trusted Data Affecting org.apache.cxf:cxf-rt-rs-security-xml package, versions [,3.6.13)[4.0.0,4.1.9)[4.2.0,4.2.4)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHECXF-21717087
- published26 Oct 2026
- disclosed9 Oct 2026
Introduced: 9 Oct 2026
NewCVE-2026-100227 (opens in a new tab)How to fix?
Upgrade org.apache.cxf:cxf-rt-rs-security-xml to version 3.6.13, 4.1.9, 4.2.4 or higher.
Overview
org.apache.cxf:cxf-rt-rs-security-xml is an Apache CXF RS XML Security library.
Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data via the AbstractXmlSigInHandler and XmlSecInInterceptor in the JAX-RS XML Security module. An attacker can wrap an element from a document signed by a trusted key in unsigned XML and send it to an affected inbound handler. The handler validates the signature while the application processes the unsigned content as trusted, allowing attacker-controlled XML to trigger unauthorized actions or changes to application data.