CVE-2026-87830Critical· 9.1▾ MidnightIn the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element witho…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 9.1
none → critical
0.3%
Last analysed / modified upstream
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
wss4j < 2.4.4wss4j >= 3.0.0, < 3.0.6wss4j >= 4.0.0, < 4.0.2Upgrade past the affected range:
wss4j 4.0.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104711Critical· 9.8Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts
CVE-2026-89238Critical· 9.1WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions …
CVE-2026-92121High· 7.5In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set
CVE-2026-95616High· 7.5An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
CVE-2026-92899Medium· 4.8Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
CVE-2026-88920Critical· 9.8An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled ke…