Severity: low Affected versions:
- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) 4.0.0 before 4.0.2 - Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) 3.0.0 before 3.0.6 - Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) before 2.4.4 Description: In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue. Credit: Reported by n0mi1k (finder) References: https://ws.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-87830 --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
