CVEvulnerability
CVE-2026-89238
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-30
- Last modified
- 2026-10-06
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-345
Description
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected configurations
• apache wss4j (< 2.4.4)
• apache wss4j (>= 3.0.0 < 3.0.6)
• apache wss4j (>= 4.0.0 < 4.0.2)
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w Vendor Advisory, Mailing List
- http://www.openwall.com/lists/oss-security/2026/09/30/11 Mailing List, Third Party Advisory