WS-Security Vulnerability in WSS4J Streaming Code by Apache

CVE-2026-92121

What is CVE-2026-92121?

In the WSS4J streaming (StAX) code, a vulnerability exists due to a signature reference using the WS-Security STR-Transform that fails to reset an internal flag. This oversight can lead to scenarios where a policy requiring the SOAP Body to be signed may incorrectly appear satisfied, even if the Body lacks an actual signature. Consequently, this flaw exposes users to potential XML Signature Wrapping attacks, thereby compromising the intended security of SOAP messages. It's crucial for users to upgrade to the fixed versions (4.0.2, 3.0.6, or 2.4.4) to mitigate this issue.

References