Not rated
CVE-2026-87830 In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted…
Description
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache WSS4J 4.0 | 4.0.0 → < 4.0.2 | 4.0.2 |
| Apache WSS4J 3.0 | 3.0.0 → < 3.0.6 | 3.0.6 |
| Apache WSS4J 2.4 | earliest → < 2.4.4 | 2.4.4 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache WSS4J
The 7 CVEs of Apache WSS4J →
CVE-2026-95616
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
Not rated
CVE-2026-92899
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
Not rated
CVE-2026-92121
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside…
Not rated
CVE-2026-89238
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header,…
Not rated