Non notée
CVE-2026-87830 In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted…
Description
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache WSS4J 4.0 | 4.0.0 → < 4.0.2 | 4.0.2 |
| Apache WSS4J 3.0 | 3.0.0 → < 3.0.6 | 3.0.6 |
| Apache WSS4J 2.4 | premières → < 2.4.4 | 2.4.4 |
Autres CVE de Apache WSS4J
Les 7 CVE de Apache WSS4J →
CVE-2026-95616
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
Non notée
CVE-2026-92899
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
Non notée
CVE-2026-92121
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside…
Non notée
CVE-2026-89238
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header,…
Non notée