< Back

CVE-2026-89238

Updated on 30 Sep 2026

Severity

9.1 Critical severity

Details

CVSS score
9.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Details

Affected product:
Apache CXF , Spring , Wildfly , jbossws-cxf , ws-wss4j
Affected packages:
wss4j-ws-security-dom @ 2.4.1-jbossorg-1 (+1199 more)