Bug 2543909 (CVE-2026-95616) - CVE-2026-95616 wss4j: Apache WSS4J: Denial of Service via integer overflow in certificate parsing
Summary: CVE-2026-95616 wss4j: Apache WSS4J: Denial of Service via integer overflow in...
Keywords:
Status: NEW
Alias: CVE-2026-95616
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-30 12:34 UTC by OSIDB Bzimport
Modified: 2026-11-06 07:39 UTC (History)
19 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-30 12:34:48 UTC 
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Note You need to log in before you can comment on or make changes to this bug.