Apache WSS4J: EncryptedHeader child confusion allows wrong header selection
Summary
Apache WSS4J, a Java library for WS-Security in SOAP web services, can select an attacker-controlled plaintext element as the decrypted SOAP header due to EncryptedHeader child confusion. This leads to incorrect confidentiality coverage and possible security policy bypass. The attacker needs to be able to send crafted SOAP messages to an affected service; no authentication is required according to the CVSS vector.
Affected
- Apache WSS4J 4.0.0 before 4.0.2
- Apache WSS4J 3.0.0 before 3.0.6
- Apache WSS4J before 2.4.4
- Default configuration: unaffected according to the CVE record
Fixed in
- Apache WSS4J 4.0.2
- Apache WSS4J 3.0.6
- Apache WSS4J 2.4.4
Workaround
Unknown.
Exploitation
- No known exploitation (CISA SSVC: Exploitation none)
- CISA SSVC: Automatable yes, Technical Impact total
- CVSS 3.1: 9.1 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Our recommendation
- Identify applications that embed Apache WSS4J, for example through Apache CXF, and check their versions.
- Upgrade to WSS4J 4.0.2, 3.0.6 or 2.4.4, depending on the branch in use, and update dependent frameworks.
- Check whether SOAP services use EncryptedHeader and security policies that rely on header encryption.
- Monitor SOAP service logs for unusual message structures until patching is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread lists.apache.org
- oss-security post CVE-2026-89238 www.openwall.com
- WSS4J 4.0.2 release github.com
- Upstream fix backport (tomitribe ws-wss4j PR 1) github.com
- Ubuntu security notice ubuntu.com
- OSV Debian entry osv.dev
- Strix CVE summary www.strix.ai
- Apache WSS4J project ws.apache.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:55.
Original description (NVD)
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.