Apache Wss4j (Apache Software Foundation) - vulnerabilities (CVEs)

7 CVEs, 7 in the last 30 days, 1 known versions, newest CVE from 2026-09-30. Vendor: Apache Software Foundation.

CVEs of Apache Wss4j

• CVE-2026-95616 - CVSS 7.5 (high), 2026-09-30: An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an…
• CVE-2026-92899 - CVSS 4.8 (medium), 2026-09-30: Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but…
• CVE-2026-92121 - CVSS 7.5 (high), 2026-09-30: In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set.…
• CVE-2026-89238 - CVSS 9.1 (critical), 2026-09-30: WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality…
• CVE-2026-88920 - CVSS 9.8 (critical), 2026-09-30: An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a…
• CVE-2026-87830 - CVSS 9.1 (critical), 2026-09-30: In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual…
• CVE-2026-85532 - CVSS 7.5 (high), 2026-09-30: Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive…