dev  

Messages by Thread

• [GH] (ws-axiom/master): Workflow run "github_actions in /. - Update #1599279213" is working again! GitBox
• CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker Colm O hEigeartaigh
• CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes Colm O hEigeartaigh
• CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures Colm O hEigeartaigh
• [GH] (ws-axiom/master): Workflow run "maven in /. - Update #1597016513" failed! GitBox
• [PR] Bump org.apache.maven.shared:maven-shared-utils from 3.4.2 to 3.5.0 [ws-axiom] via GitHub
• [PR] Bump slf4j.version from 2.0.19 to 2.0.20 [ws-xmlschema] via GitHub
  • Re: [PR] Bump slf4j.version from 2.0.19 to 2.0.20 [ws-xmlschema] via GitHub
• [PR] Bump slf4j.version from 2.0.19 to 2.0.20 [ws-wss4j] via GitHub
  • Re: [PR] Bump slf4j.version from 2.0.19 to 2.0.20 [ws-wss4j] via GitHub
• [VOTE] - Release Apache XML Schema 2.3.3 Colm O hEigeartaigh
  • Re: [VOTE] - Release Apache XML Schema 2.3.3 robertlazarski
  • Re: [VOTE] - Release Apache XML Schema 2.3.3 Alessio Soldano
  • Re: [VOTE] - Release Apache XML Schema 2.3.3 Colm O hEigeartaigh
• [PR] Fix test on JDK8 [ws-xmlschema] via GitHub
  • Re: [PR] Fix test on JDK8 [ws-xmlschema] via GitHub
• [PR] Close the connection when a remote fetch is refused before its body [ws-xmlschema] via GitHub
  • Re: [PR] Close the connection when a remote fetch is refused before its body [ws-xmlschema] via GitHub
• [PR] Check a file: location relative to the working directory as a regular… [ws-xmlschema] via GitHub
  • Re: [PR] Check a file: location relative to the working directory as a regular… [ws-xmlschema] via GitHub
• [PR] Limit entity expansion [ws-xmlschema] via GitHub
  • Re: [PR] Limit entity expansion [ws-xmlschema] via GitHub
• [PR] The walker changes the schema model [ws-xmlschema] via GitHub
  • Re: [PR] The walker changes the schema model [ws-xmlschema] via GitHub
• [PR] Refuse an element declaration with no name and no ref in the walker [ws-xmlschema] via GitHub
  • Re: [PR] Refuse an element declaration with no name and no ref in the walker [ws-xmlschema] via GitHub
• [PR] Bound the element depth of the schema parse [ws-xmlschema] via GitHub
  • Re: [PR] Bound the element depth of the schema parse [ws-xmlschema] via GitHub
• [PR] Bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 [ws-neethi] via GitHub
  • Re: [PR] Bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 [ws-neethi] via GitHub
  • Re: [PR] Bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 [ws-neethi] via GitHub
  • Re: [PR] Bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 [ws-neethi] via GitHub
• [PR] Count a cached base type's whole derivation chain against the walk depth [ws-xmlschema] via GitHub
  • Re: [PR] Count a cached base type's whole derivation chain against the walk depth [ws-xmlschema] via GitHub
• [PR] Keep complexType block, union members and keyref refer through read a… [ws-xmlschema] via GitHub
  • Re: [PR] Keep complexType block, union members and keyref refer through read a… [ws-xmlschema] via GitHub
• [PR] [WSS-730]Add post-quantum (ML-DSA / ML-KEM) support to WSS4J [ws-wss4j] via GitHub
  • Re: [PR] [WSS-730]Add post-quantum (ML-DSA / ML-KEM) support to WSS4J [ws-wss4j] via GitHub
• [PR] Do not build a wire name for an element or attribute with no name [ws-xmlschema] via GitHub
  • Re: [PR] Do not build a wire name for an element or attribute with no name [ws-xmlschema] via GitHub
• [PR] Read "1" and surrounding whitespace as true for xs:boolean attributes [ws-xmlschema] via GitHub
  • Re: [PR] Read "1" and surrounding whitespace as true for xs:boolean attributes [ws-xmlschema] via GitHub
• [PR] Fix jarFileUrlIsAllowedByDefault test on Windows [ws-wss4j] via GitHub
• [PR] Check the file the parser opens for a relative schema location [ws-xmlschema] via GitHub
  • Re: [PR] Check the file the parser opens for a relative schema location [ws-xmlschema] via GitHub
• [PR] Do not declare an empty prefix for an unhandled attribute value [ws-xmlschema] via GitHub
  • Re: [PR] Do not declare an empty prefix for an unhandled attribute value [ws-xmlschema] via GitHub
• [PR] Allow an xs:all alongside an empty particle in a complex content exte… [ws-xmlschema] via GitHub
  • Re: [PR] Allow an xs:all alongside an empty particle in a complex content exte… [ws-xmlschema] via GitHub
• [PR] Fix the path finder refusing or failing on common valid documents [ws-xmlschema] via GitHub
  • Re: [PR] Fix the path finder refusing or failing on common valid documents [ws-xmlschema] via GitHub
• [PR] Misc fixes [ws-xmlschema] via GitHub
  • Re: [PR] Misc fixes [ws-xmlschema] via GitHub
  • [PR] Misc fixes [ws-xmlschema] via GitHub
  • Re: [PR] Misc fixes [ws-xmlschema] via GitHub
• [PR] Collect ancestor prefix declarations without recursion [ws-xmlschema] via GitHub
  • Re: [PR] Collect ancestor prefix declarations without recursion [ws-xmlschema] via GitHub
• [PR] Check that a relative schema location is a regular file [ws-xmlschema] via GitHub
  • Re: [PR] Check that a relative schema location is a regular file [ws-xmlschema] via GitHub
• [PR] Bound the nesting depth of annotation markup [ws-xmlschema] via GitHub
  • Re: [PR] Bound the nesting depth of annotation markup [ws-xmlschema] via GitHub
• [PR] Make sure file references are to actual files [ws-xmlschema] via GitHub
  • Re: [PR] Make sure file references are to actual files [ws-xmlschema] via GitHub
• [PR] Bump xmlunit.version from 2.13.0 to 2.14.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump xmlunit.version from 2.13.0 to 2.14.0 [ws-wss4j] via GitHub
• [PR] Adding new org.apache.ws.commons.schema.remote.checkAddresses property [ws-xmlschema] via GitHub
  • Re: [PR] Adding new org.apache.ws.commons.schema.remote.checkAddresses property [ws-xmlschema] via GitHub
• [PR] Add a bound on the number of redirects the DefaultURIResolver can do [ws-xmlschema] via GitHub
  • Re: [PR] Add a bound on the number of redirects the DefaultURIResolver can do [ws-xmlschema] via GitHub
• [PR] Walker: bound the depth of an acyclic schema walk [ws-xmlschema] via GitHub
  • Re: [PR] Walker: bound the depth of an acyclic schema walk [ws-xmlschema] via GitHub
• [PR] inherit the substitution group head's type for untyped elements [ws-xmlschema] via GitHub
  • Re: [PR] inherit the substitution group head's type for untyped elements [ws-xmlschema] via GitHub
• [PR] Bump org.apache:apache from 39 to 40 [ws-xmlschema] via GitHub
  • Re: [PR] Bump org.apache:apache from 39 to 40 [ws-xmlschema] via GitHub
• [PR] Bump org.apache:apache from 39 to 40 [ws-neethi] via GitHub
  • Re: [PR] Bump org.apache:apache from 39 to 40 [ws-neethi] via GitHub
• [VOTE] - Release Apache WSS4J 4.0.2, 3.0.6, 2.4.4 Colm O hEigeartaigh
  • Re: [VOTE] - Release Apache WSS4J 4.0.2, 3.0.6, 2.4.4 Daniel Kulp
  • Re: [VOTE] - Release Apache WSS4J 4.0.2, 3.0.6, 2.4.4 Alessio Soldano
• [PR] Bump org.apache:apache from 39 to 40 [ws-wss4j] via GitHub
• [PR] WSS4J messages now render correctly even if Santuario is never initia… [ws-wss4j] via GitHub
  • Re: [PR] WSS4J messages now render correctly even if Santuario is never initia… [ws-wss4j] via GitHub
• [jira] [Created] (WSS-730) Add post-quantum cryptography (ML-DSA / ML-KEM) support Freeman Yue Fang (Jira)
• Jenkins build became unstable: webservices » Apache WSS4J - master JDK17 #162 Apache Jenkins Server
  • Jenkins build is back to stable : webservices » Apache WSS4J - master JDK17 #163 Apache Jenkins Server
• Jenkins build became unstable: webservices » Apache WSS4J - master JDK17 » Apache WSS4J WS-Security Common #162 Apache Jenkins Server
  • Jenkins build is back to stable : webservices » Apache WSS4J - master JDK17 » Apache WSS4J WS-Security Common #163 Apache Jenkins Server
• [jira] [Resolved] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) Colm O hEigeartaigh (Jira)
• [PR] Xop hardening fix [ws-wss4j] via GitHub
  • Re: [PR] Xop hardening fix [ws-wss4j] via GitHub
• [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) Colm O hEigeartaigh (Jira)
• [PR] WSS-727 - Minor cleanup [ws-wss4j] via GitHub
  • Re: [PR] WSS-727 - Minor cleanup [ws-wss4j] via GitHub
• [PR] Fixing AKI bug [ws-wss4j] via GitHub
  • Re: [PR] Fixing AKI bug [ws-wss4j] via GitHub
• [jira] [Work started] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) Colm O hEigeartaigh (Jira)
• [PR] Finishing DER work [ws-wss4j] via GitHub
  • Re: [PR] Finishing DER work [ws-wss4j] via GitHub
  • Re: [PR] Finishing DER work [ws-wss4j] via GitHub
• [jira] [Closed] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) Colm O hEigeartaigh (Jira)
• [jira] [Resolved] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) Colm O hEigeartaigh (Jira)
• [jira] [Updated] (WSS-713) Support SubjectConfirmationData for SAML-SV v1 Colm O hEigeartaigh (Jira)
• [jira] [Updated] (WSS-721) Merlin Trust Optimization Request Colm O hEigeartaigh (Jira)
• [jira] [Updated] (WSS-416) Update ConditionsBean to support additional conditions such as Delegate Colm O hEigeartaigh (Jira)
• [PR] Bump org.xmlunit:xmlunit-assertj3 from 2.13.0 to 2.14.0 [ws-axiom] via GitHub
  • Re: [PR] Bump org.xmlunit:xmlunit-assertj3 from 2.13.0 to 2.14.0 [ws-axiom] via GitHub
• [PR] Update certs that are failing with the Bouncycastle update [ws-wss4j] via GitHub
  • Re: [PR] Update certs that are failing with the Bouncycastle update [ws-wss4j] via GitHub
• [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
  • Re: [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
  • Re: [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
  • Re: [PR] Follow-on from last DER patch [ws-wss4j] via GitHub
• [PR] Fix timestamp parsing [ws-wss4j] via GitHub
  • Re: [PR] Fix timestamp parsing [ws-wss4j] via GitHub
• [PR] Fix SenderVouches EncryptedKey case [ws-wss4j] via GitHub
  • Re: [PR] Fix SenderVouches EncryptedKey case [ws-wss4j] via GitHub
• [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-wss4j] via GitHub
• [PR] Switch to use BASE-64 encoding rather than 32 bit hash values for sig… [ws-wss4j] via GitHub
  • Re: [PR] Switch to use BASE-64 encoding rather than 32 bit hash values for sig… [ws-wss4j] via GitHub
• [PR] Align StaX sender vouches with DOM layer [ws-wss4j] via GitHub
  • Re: [PR] Align StaX sender vouches with DOM layer [ws-wss4j] via GitHub
• [PR] Fix SAML Conditions parsing [ws-wss4j] via GitHub
  • Re: [PR] Fix SAML Conditions parsing [ws-wss4j] via GitHub
• [PR] StAX SAML subject confirmation skipped for an empty SOAP Body [ws-wss4j] via GitHub
  • Re: [PR] StAX SAML subject confirmation skipped for an empty SOAP Body [ws-wss4j] via GitHub
• [PR] Extend the EncryptedKey random-key fallback beyond decryptDataRef [ws-wss4j] via GitHub
  • Re: [PR] Extend the EncryptedKey random-key fallback beyond decryptDataRef [ws-wss4j] via GitHub
• [PR] Properly wire UsernameToken + RSA15 flags for the streaming layer [ws-wss4j] via GitHub
  • Re: [PR] Properly wire UsernameToken + RSA15 flags for the streaming layer [ws-wss4j] via GitHub
• [PR] Stricter policy enforcement [ws-wss4j] via GitHub
  • Re: [PR] Stricter policy enforcement [ws-wss4j] via GitHub
• [PR] Bound the encrypted data nesting depth [ws-wss4j] via GitHub
  • Re: [PR] Bound the encrypted data nesting depth [ws-wss4j] via GitHub
  • Re: [PR] Bound the encrypted data nesting depth [ws-wss4j] via GitHub
• [PR] Document streaming policy enforcement [ws-wss4j] via GitHub
  • Re: [PR] Document streaming policy enforcement [ws-wss4j] via GitHub
• [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-axiom] via GitHub
• [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
  • Re: [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
  • Re: [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
  • Re: [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] via GitHub
• [PR] Redact passwords from UsernameToken toString [ws-wss4j] via GitHub
  • Re: [PR] Redact passwords from UsernameToken toString [ws-wss4j] via GitHub
• CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely Colm O hEigeartaigh
• CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service Colm O hEigeartaigh
• CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service Colm O hEigeartaigh
• CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion Colm O hEigeartaigh
• CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service Colm O hEigeartaigh
• [PR] Updating Neethi to 3.2.4 [ws-wss4j] via GitHub
  • Re: [PR] Updating Neethi to 3.2.4 [ws-wss4j] via GitHub
• [PR] Additional Bleichenbacher fix [ws-wss4j] via GitHub
  • Re: [PR] Additional Bleichenbacher fix [ws-wss4j] via GitHub
  • Re: [PR] Additional Bleichenbacher fix [ws-wss4j] via GitHub
• [PR] Set trust when there is no KeyInfo and the certificate comes from a l… [ws-wss4j] via GitHub
  • Re: [PR] Set trust when there is no KeyInfo and the certificate comes from a l… [ws-wss4j] via GitHub
• [PR] Putting max on UsernameToken stax iterations [ws-wss4j] via GitHub
  • Re: [PR] Putting max on UsernameToken stax iterations [ws-wss4j] via GitHub
• [PR] Adding docs about trust credentials for BST [ws-wss4j] via GitHub
  • Re: [PR] Adding docs about trust credentials for BST [ws-wss4j] via GitHub
• [PR] Only set trust validation for Signature when we have a trusted source [ws-wss4j] via GitHub
  • Re: [PR] Only set trust validation for Signature when we have a trusted source [ws-wss4j] via GitHub
• [PR] Add a new property to disable reading local files [ws-xmlschema] via GitHub
  • Re: [PR] Add a new property to disable reading local files [ws-xmlschema] via GitHub
• [PR] Add a switch to allow network resolution to be turned off [ws-xmlschema] via GitHub
  • Re: [PR] Add a switch to allow network resolution to be turned off [ws-xmlschema] via GitHub
• [PR] Stop capturing foreign children of the document element [ws-xmlschema] via GitHub
  • Re: [PR] Stop capturing foreign children of the document element [ws-xmlschema] via GitHub
• [PR] Serialize notation as well and fix some NPEs [ws-xmlschema] via GitHub
  • Re: [PR] Serialize notation as well and fix some NPEs [ws-xmlschema] via GitHub
• [PR] Fix nonce encoding issue [ws-wss4j] via GitHub
  • Re: [PR] Fix nonce encoding issue [ws-wss4j] via GitHub
• [PR] Fix signature replay caching [ws-wss4j] via GitHub
  • Re: [PR] Fix signature replay caching [ws-wss4j] via GitHub
• [PR] Report unresolvable and complex-where-simple type references as XmlSc… [ws-xmlschema] via GitHub
  • Re: [PR] Report unresolvable and complex-where-simple type references as XmlSc… [ws-xmlschema] via GitHub
• [PR] Keep document-walk failures distinguishable [ws-xmlschema] via GitHub
  • Re: [PR] Keep document-walk failures distinguishable [ws-xmlschema] via GitHub
• [PR] Fix StAX replaycache tests [ws-wss4j] via GitHub
  • Re: [PR] Fix StAX replaycache tests [ws-wss4j] via GitHub
• [PR] Bump org.apache:apache from 37 to 39 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache:apache from 37 to 39 [ws-wss4j] via GitHub
• [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 [ws-wss4j] via GitHub
• [PR] Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 [ws-wss4j] via GitHub
  • Re: [PR] Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 [ws-wss4j] via GitHub
• [PR] Fix scchema resolution budget bug [ws-xmlschema] via GitHub
  • Re: [PR] Fix scchema resolution budget bug [ws-xmlschema] via GitHub
• [PR] Place default limits on read timeouts + size on remote schemas [ws-xmlschema] via GitHub
  • Re: [PR] Place default limits on read timeouts + size on remote schemas [ws-xmlschema] via GitHub
• Build failed in Jenkins: webservices » Apache WSS4J - 2.3.x-fixes JDK 8 #42 Apache Jenkins Server
• [PR] Fix some potential NPEs [ws-xmlschema] via GitHub
  • Re: [PR] Fix some potential NPEs [ws-xmlschema] via GitHub
• [PR] Exclude a few other things by default in DefaultURIResolver [ws-xmlschema] via GitHub
  • Re: [PR] Exclude a few other things by default in DefaultURIResolver [ws-xmlschema] via GitHub
• [PR] Updating docs for remote URI dereferencing [ws-xmlschema] via GitHub
  • Re: [PR] Updating docs for remote URI dereferencing [ws-xmlschema] via GitHub
• [PR] Restrict default protocols allowed by the DefaultURIResolver [ws-xmlschema] via GitHub
  • Re: [PR] Restrict default protocols allowed by the DefaultURIResolver [ws-xmlschema] via GitHub

• Earlier messages