by Kastro
Paper/Archive/CVE-2026-89238

CVE-2026-89238

Apache Software Foundation Apache WSS4J — Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 26.3.263 × 205.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected

ProductAffectedFixed inSource
Apache WSS4J4.0.0 – < 4.0.24.0.2CNA
Apache WSS4J3.0.0 – < 3.0.63.0.6CNA
Apache WSS4J< 2.4.42.4.4CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22wrefopenwall.com/lists/oss-security/2026/09/30/11