CVE-2026-92121

HighCVSS 7.5

Published: 30/09/2026(UTC)Updated: 06/10/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

Summary

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2, 3.0.6, or 2.4.4 which fix this issue.

Risk Assessment

An attacker may exploit XML Signature Wrapping to bypass security policy, potentially leading to unauthorized access to operations or data.

Recommendation

It is recommended to upgrade WSS4J to versions 4.0.2, 3.0.6, or 2.4.4 which fix this issue.

Other vulnerabilities in WSS4J

CVE-2026-95616High
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.

Original NVD description (English source)

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS