Security Advisories

For information on how to report a new security problem please see here.

The following security advisories have been issued for Apache WSS4J™:

• 2026
• CVE-2026-85532 - Apache WSS4J: Insufficient Validation of Derived-Key Parameters.
• CVE-2026-87830 - Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
• CVE-2026-88920 - Apache WSS4J: SAML Sender-Vouches Authentication Bypass.
• CVE-2026-89238 - Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection.
• CVE-2026-92121 - Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference.
• CVE-2026-92899 - Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce.
• CVE-2026-95616 - Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions.
• 2015
• CVE-2015-0226 - Apache WSS4J is (still) vulnerable to Bleichenbacher's attack.
• CVE-2015-0227 - Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

As Apache WSS4J is a library that provides WS-Security functionality to web service stacks such as Apache CXF and Apache Axis, security issues associated with WS-Security tend to be reported to these downstream projects. Therefore the best way to keep an eye on security issues involving WSS4J is to look at the security advisories pages of these projects.

The security advisory page for Apache CXF is here. In particular, the following security advisories are relevant to users of WSS4J:

• Note on CVE-2012-5575 - XML Encryption backwards compatibility attack on Apache CXF.
• Note on CVE-2011-2487 - Bleichenbacher attack against distributed symmetric key in WS-Security.
• Note on CVE-2011-1096 - XML Encryption flaw / Character pattern encoding attack.