Source Package: wss4j (1.6.19-3)
Apache WSS4J WS-Security implementation
The following binary packages are built from this source package:
- libwss4j-java
Apache WSS4J WS-Security implementation
Packages / Debian 12 (Bookworm) / Source / java / wss4j
Known vulnerabilities
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-95616] Published: An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifi | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-92899] Published: Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes | Medium(4.8) | AffectedDetails (2)
|
| [CVE-2026-89238] Published: WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users ar | Critical(9.1) | AffectedDetails (2)
|
| [CVE-2026-85532] Published: Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-88920] Published: An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion | Critical(9.8) | AffectedDetails (2)
|
Fixed and unaffected versions (4)
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-92121] Published: In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that | High(7.5) | Not affectedDetails (2)
|
| [CVE-2026-87830] Published: In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may th | Critical(9.1) | Not affectedDetails (2)
|
| [CVE-2015-0226] Published: wss4j: CVE-2015-0226 | Medium | FixedDetails (2)
|
| [CVE-2015-0227] Published: wss4j: CVE-2015-0227 | Medium | FixedDetails (2)
|
Last synced:
Sources
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified