CVE-2026-89238

UNKNOWN 0.0

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Vendor	apache software foundation
Product	apache wss4j
Published	Sep 30, 2026
Last Updated	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache wss4j

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache wss4j are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache WSS4J

4.0.0 < 4.0.2 3.0.0 < 3.0.6 0 < 2.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w openwall.com: http://www.openwall.com/lists/oss-security/2026/09/30/11

Credits

Reported by n0mi1k