Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-85532

Apache WSS4J: Insufficient Validation of Derived-Key Parameters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache WSS4J

Default version status: unaffected

  • 4.0.0 to < 4.0.2affected
  • 3.0.0 to < 3.0.6affected
  • 0 to < 2.4.4affected
pkg:maven/org.apache.wss4j/wss4j-ws-security-common

References