Apache Wss4j
12 CVEs affecting Apache Wss4j. Latest disclosed: 2026-09-30. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-88920 | Critical | 9.8 | 2026-09-30 | An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a craft… |
CVE-2026-89238 | Critical | 9.1 | 2026-09-30 | WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality cove… |
CVE-2026-87830 | Critical | 9.1 | 2026-09-30 | In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XM… |
CVE-2020-13936 | High | 8.8 | 2021-03-10 | An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account… |
CVE-2026-95616 | High | 7.5 | 2026-09-30 | An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X… |
CVE-2026-92121 | High | 7.5 | 2026-09-30 | In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set… |
CVE-2026-85532 | High | 7.5 | 2026-09-30 | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive C… |
CVE-2015-0226 | High | 7.5 | 2017-10-30 | Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, whic… |
CVE-2011-2487 | Medium | 5.9 | 2020-03-11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack. |
CVE-2026-92899 | Medium | 4.8 | 2026-09-30 | Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentica… |
CVE-2015-0227 | | 2015-02-12 | Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to… | |
CVE-2014-3623 | | 2014-10-30 | Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not proper… |