Vulnerability in StAX Streaming WS-SecurityPolicy Validator in Apache Products
CVE-2026-87830

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Wss4j
Vendor
CVE Published:
30 September 2026

What is CVE-2026-87830?

The StAX streaming WS-SecurityPolicy validator in Apache products faces a critical flaw where certain relative or unsupported XPath expressions fail to match actual XML element paths. This can allow a remote SOAP peer to send a necessary element without the expected signature or encryption, potentially compromising data integrity and confidentiality. To mitigate this risk, users should upgrade to the recommended versions 4.0.2, 3.0.6, or 2.4.4 as soon as possible.

Affected Version(s)

Apache WSS4J 4.0.0 < 4.0.2

Apache WSS4J 3.0.0 < 3.0.6

Apache WSS4J 0 < 2.4.4

References

https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvo...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by n0mi1k
.