CVE-2026-87830
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
| Vendor | apache software foundation |
| Product | apache wss4j |
| Published | Sep 30, 2026 |
| Last Updated | Sep 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache wss4j
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache wss4j are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache WSS4J
4.0.0 < 4.0.2 3.0.0 < 3.0.6 0 < 2.4.4
References
Credits
Reported by n0mi1k