CVE-2026-95616

published 2026-09-30

CVE-2026-95616: An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an…

Priority P3 45 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	wss4j	< 2.4.4	2.4.4
apache	wss4j	>= 3.0.0 < 3.0.6	3.0.6
apache	wss4j	>= 4.0.0 < 4.0.2	4.0.2
apache_software_foundation	apache_wss4j	< 2.4.4	2.4.4
apache_software_foundation	apache_wss4j	>= 3.0.0 < 3.0.6	3.0.6
apache_software_foundation	apache_wss4j	>= 4.0.0 < 4.0.2	4.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-190