Apache Wss4j vulnerabilities

• apache wss4j Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions CVE-2026-95616 7.5 HighSeptember 30, 2026
• apache wss4j Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce CVE-2026-92899 4.8 MediumSeptember 30, 2026
• apache wss4j Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference CVE-2026-92121 Fix available 7.5 HighSeptember 30, 2026
• apache wss4j Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection CVE-2026-89238 9.1 CriticalSeptember 30, 2026
• apache wss4j Apache WSS4J: SAML Sender-Vouches Authentication Bypass CVE-2026-88920 9.8 CriticalSeptember 30, 2026
• apache wss4j Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. CVE-2026-87830 9.1 CriticalSeptember 30, 2026
• apache wss4j Apache WSS4J: Insufficient Validation of Derived-Key Parameters CVE-2026-85532 7.5 HighSeptember 30, 2026
• apache velocity engine, wss4j, debian linux +13 more +15 more Velocity Sandbox Bypass CVE-2020-13936 Fix available EPSS 22.7% 8.8 HighMarch 10, 2021
• apache wss4j, red hat jbossws, apache cxf +8 more +10 more Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J CVE-2011-2487 Fix available 5.9 MediumMarch 11, 2020
• apache wss4j Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J CVE-2015-0226 Fix available 7.5 HighOctober 30, 2017
• apache wss4j Improper Access Control in Apache WSS4J CVE-2015-0227 Fix available 5.0 MediumFebruary 12, 2015
• apache cxf, wss4j +1 more Improper Authentication in Apache WSS4J CVE-2014-3623 Fix available 5.0 MediumOctober 30, 2014