CVE-2026-95616

HighCVSS 7.5

Published: 30/09/2026(UTC)Updated: 06/10/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.

Risk Assessment

An attacker can cause server memory exhaustion, leading to denial of service (DoS).

Recommendation

Upgrade WSS4J to versions 4.0.2, 3.0.6, or 2.4.4, which fix this issue.

Other vulnerabilities in WSS4J

CVE-2026-92121High
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2, 3.0.6, or 2.4.4 which fix this issue.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS