PT-2026-103129
CVE-2026-85532
·
تاريخ النشر
2026-09-30
·
تاريخ التحديث
2026-10-02
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Apache WSS4J versions prior to 4.0.2
Apache WSS4J versions prior to 3.0.6
Apache WSS4J versions prior to 2.4.4
Description
Apache WSS4J fails to properly validate bounds for derived-key lengths and offsets provided by a user. This flaw allows the processing of crafted WS-Security messages to result in the use of cryptographically weak keys or cause excessive CPU and memory consumption.
Recommendations
Upgrade to version 4.0.2.
Upgrade to version 3.0.6.
Upgrade to version 2.4.4.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾