[ CVE-2026-89238 · Published 30 Sep 2026 ]

Vulnerability in Apache Software Foundation Apache WSS4J

CVSS 9.1 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

Critical severity: CVSS 9.1

[ Description ]Official description

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22wVendor AdvisoryMailing List
www.openwall.com/lists/oss-security/2026/09/30/11Mailing ListThird Party Advisory