Critical severity · published Sep 30, 2026
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Apache WSS4J · Apache Software Foundation
4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4 · source: vendor
WS
Wss4j · Apache
before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89238
vendor-advisory
https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
More from Apache WSS4J
9.8
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
9.1
CVE-2026-87830
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
7.5
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
7.5
CVE-2026-92121
Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
7.5
CVE-2026-85532
Apache WSS4J: Insufficient Validation of Derived-Key Parameters