Non notée
CVE-2026-85532 Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds
Description
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache WSS4J 4.0 | 4.0.0 → < 4.0.2 | 4.0.2 |
| Apache WSS4J 3.0 | 3.0.0 → < 3.0.6 | 3.0.6 |
| Apache WSS4J 2.4 | premières → < 2.4.4 | 2.4.4 |
Autres CVE de Apache WSS4J
Les 7 CVE de Apache WSS4J →
CVE-2026-95616
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
Non notée
CVE-2026-92899
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
Non notée
CVE-2026-92121
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside…
Non notée
CVE-2026-89238
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header,…
Non notée