PT-2026-103129

CVE-2026-85532

Published

2026-09-30

Updated

2026-10-02

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4

Description Apache WSS4J fails to properly validate bounds for derived-key lengths and offsets provided by a user. This flaw allows the processing of crafted WS-Security messages to result in the use of cryptographically weak keys or cause excessive CPU and memory consumption.

Recommendations Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.

Exploitability

Fix

Impacts

Researchers

Claude Agents

Ho1Aas

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers