CVE-2026-89238CWE-345

CVE-2026-89238

Critical · published September 30, 2026

CVSS v3.1

9.1

EPSS

Percentile

17.5

In the wild

Unconfirmed

What it is

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.

Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

The record

Technical detail

CVSS v3.1: 9.1 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00266 · 17.5th percentile
Weakness: CWE-345 · Insufficient Verification of Data Authenticity
Published: 2026-09-30T17:17Z

Affected products (3)

Product	Versions	Fixed in
apache/wss4j	< 2.4.4	2.4.4
apache/wss4j	≥ 3.0.0, < 3.0.6	3.0.6
apache/wss4j	≥ 4.0.0, < 4.0.2	4.0.2

References (2)

https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w · [email protected]http://www.openwall.com/lists/oss-security/2026/09/30/11 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

02 OCT 03:46Z
EPSS moved — → 0%
epss
30 SEP 11:59Z
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
cvelistv5