CVE-2026-89238

Name of the Vulnerable Software and Affected Versions WSS4J versions prior to 4.0.2 WSS4J versions prior to 3.0.6 WSS4J versions prior to 2.4.4

Description An issue in the EncryptedHeader component allows child confusion, which could enable an attacker to promote a plaintext element as the decrypted header. This leads to incorrect confidentiality coverage and a potential policy bypass.

Recommendations Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.