CVE-2026-95616: wss4j before 2.4.4 (exclusive), from 3.0.0 (inclusive), before 3.0.6 (exclusive), from 4.0.0 (inclusive), before 4.0.2…

Affected technology

wss4j · before 2.4.4 (exclusive)
apache

wss4j · from 3.0.0 (inclusive), before 3.0.6 (exclusive)
apache

wss4j · from 4.0.0 (inclusive), before 4.0.2 (exclusive)
apache

Apache WSS4J · 4.0.0 to before 4.0.2, 3.0.0 to before 3.0.6, 0 to before 2.4.4
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Source advisory’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.