Apache WSS4J Derived-Key Length/Offset Bounds Bypass v4.0.2/3.0.6/2.4.4
CVE-2026-85532 Published on September 30, 2026
Apache WSS4J: Insufficient Validation of Derived-Key Parameters
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2026-85532
Want to know whenever a new CVE is published for Apache Wss4j? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache WSS4J:- Version 4.0.0 and below 4.0.2 is affected.
- Version 3.0.0 and below 3.0.6 is affected.
- Before 2.4.4 is affected.