The vulnerability resides in Apache CXF’s JwsJsonContainerRequestFilter. It allows an attacker to craft a WS‑JSON request that contains metadata not authenticated by the accepted signature, causing CXF to process unverified data. This bypasses the framework’s expectation that accepted Content‑Type or protected HTTP‑header metadata comes from a verified signature entry, potentially steering downstream JAX‑RS entity parsing or signed‑header consistency checks. The impact includes unauthorized handling of requests, data leakage, or compromise of the application’s request‑processing integrity.

The flaw affects Apache CXF, a web services framework from the Apache Software Foundation. All versions prior to 4.2.2, 4.1.7, and 3.6.12 are vulnerable. Users should upgrade to at least these versions to remediate the issue.

The CVSS score is 6.5, but the nature of the flaw suggests high potential for exploitation, especially in exposed web services environments. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Inferred attack vectors involve remote attackers sending crafted WS‑JSON requests to vulnerable services; the flaw does not require local access or privileged credentials. Given the bypass of critical signature verification, the risk to confidentiality, integrity, and availability of the affected application is significant. Monitoring for abnormal signature entries and applying the vendor’s patch are essential to mitigate this threat.