Advisories · Technology

Apache Software Foundation Apache WSS4J.

Every CVE that names Apache Software Foundation Apache WSS4J among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-95616 CVE record

CVSS 7.5 High

Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
- Apache Software Foundation Apache WSS4J
- Memory corruption
Not analysed yet 30 Sept 2026
CVE-2026-92899 CVE record

CVSS 4.8 Medium

Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
- Apache Software Foundation Apache WSS4J
- Authentication bypass
Not analysed yet 30 Sept 2026
CVE-2026-92121 CVE record

CVSS 7.5 High

Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
- Apache Software Foundation Apache WSS4J
- CWE-693
Not analysed yet 30 Sept 2026
CVE-2026-89238 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
- Apache Software Foundation Apache WSS4J
- CWE-345
Not analysed yet 30 Sept 2026
CVE-2026-88920 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache WSS4J: SAML Sender-Vouches Authentication Bypass
- Apache Software Foundation Apache WSS4J
- Authentication bypass
Not analysed yet 30 Sept 2026
CVE-2026-87830 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
- Apache Software Foundation Apache WSS4J
- Code injection
Not analysed yet 30 Sept 2026
CVE-2026-85532 CVE record

CVSS 7.5 High

Apache WSS4J: Insufficient Validation of Derived-Key Parameters
- Apache Software Foundation Apache WSS4J
- CWE-20
Not analysed yet 30 Sept 2026