CVE-2026-89238

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w	Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2026/09/30/11	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:wss4j::::::::
	cpe:2.3:a:apache:wss4j::::::::
	cpe:2.3:a:apache:wss4j::::::::

History

06 Oct 2026, 17:26

Type	Values Removed	Values Added
CPE		cpe:2.3:a:apache:wss4j::::::::
First Time		Apache Apache wss4j
References	~~() https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w -~~	() https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w - Vendor Advisory, Mailing List
References	~~() http://www.openwall.com/lists/oss-security/2026/09/30/11 -~~	() http://www.openwall.com/lists/oss-security/2026/09/30/11 - Mailing List, Third Party Advisory

30 Sep 2026, 20:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1
CWE		CWE-345

30 Sep 2026, 13:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 13:17

Updated : 2026-10-06 17:26

NVD link : CVE-2026-89238

Mitre link : CVE-2026-89238

CVE.ORG link : CVE-2026-89238

JSON object : View

Products Affected

apache

wss4j

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-89238", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89238", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-30T19:49:38.121856Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache WSS4J", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.2", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.4.4", "versionType": "semver"}], "packageURL": "pkg:maven/org.apache.wss4j/wss4j-ws-security-dom", "packageName": "org.apache.wss4j:wss4j-ws-security-dom", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-09-30T13:17:21.587", "references": [{"url": "https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w", "tags": ["Vendor Advisory", "Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/30/11", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}], "lastModified": "2026-10-06T17:26:05.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3409718-5467-407D-9B51-14E58B6D2F68", "versionEndExcluding": "2.4.4"}, {"criteria": "cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31AFF243-7BCE-44BC-85C5-6FE257642C13", "versionEndExcluding": "3.0.6", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20E76C98-444D-4DB5-91E0-90E84C196158", "versionEndExcluding": "4.0.2", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}