CVE-2026-88920

Mô tả

Tham khảo

• lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9 · Mailing List
• openwall.com/lists/oss-security/2026/09/30/10 · Mailing List

Lỗ hổng khác của wss4j

• CVE-2026-95616CAO 7.5An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP me…
• CVE-2026-92899TRUNG BÌNH 4.8Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 t…
• CVE-2026-92121CAO 7.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" fla…
• CVE-2026-89238NGHIÊM TRỌNG 9.1WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect c…
• CVE-2026-87830NGHIÊM TRỌNG 9.1In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never …