CVE-2026-89238

Published: Sep 30, 2026Modified: Oct 6, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected (3)

Products: Apache: Wss4j

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Wss4j	Before 2.4.4
Apache Wss4j	From 3.0.0 to 3.0.6
Apache Wss4j	From 4.0.0 to 4.0.2

Related CWEs

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w

Source: security@apache.org

Vendor AdvisoryMailing List

http://www.openwall.com/lists/oss-security/2026/09/30/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.