CVE-2026-95616
highpriority · track · 0EPSS 0.004 · 35 %ileUSEPSS · scored 2026-10-28
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
sources
Which sources assert this record, and when.
references (2) nvd
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/09/30/14Mailing ListThird Party Advisory
- https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hctVendor AdvisoryMailing List
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan