What’s Vulnerable › Products

Apache Software Foundation Apache WSS4J vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Apache Software Foundation Apache WSS4J version is affected

Latest Apache Software Foundation Apache WSS4J vulnerabilities

• CVE-2026-95616 — Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions (CVSS 7.5)
• CVE-2026-92899 — Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce (CVSS 4.8)
• CVE-2026-92121 — Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference (CVSS 7.5)
• CVE-2026-89238 — Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection (CVSS 9.1)
• CVE-2026-88920 — Apache WSS4J: SAML Sender-Vouches Authentication Bypass (CVSS 9.8)
• CVE-2026-87830 — Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. (CVSS 9.1)
• CVE-2026-85532 — Apache WSS4J: Insufficient Validation of Derived-Key Parameters (CVSS 7.5)
• CVE-2020-13936 — Velocity Sandbox Bypass (CVSS 8.8)
• CVE-2011-2487 — (CVSS 5.9)
• CVE-2015-0226 — (CVSS 7.5)
• CVE-2015-0227 — (CVSS 5.0)
• CVE-2014-3623 — (CVSS 5.0)