CVE-2026-87830

概要

参考情報

• lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn · Vendor Advisory
• openwall.com/lists/oss-security/2026/09/30/9 · Mailing List

wss4j のその他の脆弱性

• CVE-2026-95616高 7.5An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP me…
• CVE-2026-92899中 4.8Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 t…
• CVE-2026-92121高 7.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" fla…
• CVE-2026-89238緊急 9.1WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect c…
• CVE-2026-88920緊急 9.8An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP m…