PatchTheCVEwss4j vulnerabilities and fixes
Recent CVEs affecting wss4j, with upgrade or downgrade steps. 7 tracked.
wss4j has 7 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-09-30. Highest priority: CVE-2026-88920 (score 59/100).
- CVE-2026-87830 CRITICAL 9.1 UPGRADE In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be co
- CVE-2026-89238 CRITICAL 9.1 UPGRADE WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted
- CVE-2026-92121 HIGH 7.5 UPGRADE In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an intern
- CVE-2026-95616 HIGH 7.5 UPGRADE An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
- CVE-2026-92899 MEDIUM 4.8 UPGRADE Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
- CVE-2026-88920 CRITICAL 9.8 UPGRADE An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers
- CVE-2026-85532 HIGH 7.5 UPGRADE Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds
FAQ
How do I fix wss4j vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wss4j being exploited right now?
None of the tracked wss4j CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wss4j CVE should I patch first?
CVE-2026-88920 currently ranks highest (59/100): An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers.