CVE-2026-87830CWE-917

CVE-2026-87830

Critical · published September 30, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.

Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.1th percentile
Weakness
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Published
2026-09-30T16:17Z
Affected products (3)
ProductVersionsFixed in
apache/wss4j< 2.4.42.4.4
apache/wss4j≥ 3.0.0, < 3.0.63.0.6
apache/wss4j≥ 4.0.0, < 4.0.24.0.2
References (2)
https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn · [email protected]http://www.openwall.com/lists/oss-security/2026/09/30/9 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 OCT 03:46Z
    EPSS moved — → 0%
    epss
  • 30 SEP 11:57Z
    Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
    cvelistv5