CVE-2026-85532

published 2026-09-30

CVE-2026-85532: Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	wss4j	< 2.4.4	2.4.4
apache	wss4j	>= 3.0.0 < 3.0.6	3.0.6
apache	wss4j	>= 4.0.0 < 4.0.2	4.0.2
apache_software_foundation	apache_wss4j	< 2.4.4	2.4.4
apache_software_foundation	apache_wss4j	>= 3.0.0 < 3.0.6	3.0.6
apache_software_foundation	apache_wss4j	>= 4.0.0 < 4.0.2	4.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20