← Vulnerability feed

Vulnerability record · CVE-2026-85532 · published 30 September 2026

CVE-2026-85532: Apache wss4j improper input validation vulnerability

Apache · Wss4j

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

7.5 CVSS 3.1 High EPSS 0.55% · top 56.0% CWE-20 · Improper input validation
7.5CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
2 Oct 2026Last modified by NVD

Description

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6 Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/30/8 Mailing ListThird Party Advisory

Track CVE-2026-85532 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-88920Apache wss4j improper authentication vulnerabilityAn authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages v…EPSS 0.57%8.8CVE-2020-13936Apache velocity engine vulnerabilityAn attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as th…EPSS 23%7.5CVE-2015-0226Apache wss4j broken cryptographic algorithm vulnerabilityApache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message …EPSS 5.5%5.9CVE-2011-2487Apache cxf broken cryptographic algorithm vulnerabilityThe implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbac…EPSS 1.8%5.0CVE-2015-0227Apache wss4j permissions and access controls vulnerabilityApache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors …EPSS 7.5%5.0CVE-2014-3623Apache wss4j improper authentication vulnerabilityApache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does …EPSS 9.2%4.8CVE-2026-92899Apache wss4j authentication bypass by spoofing vulnerabilityApache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but …EPSS 0.51%9.5CVE-2026-88771Citrix netscaler application delivery controller improper input validation vulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEVEPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2026-85532), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.