CVE-2026-85532

Summary

Apache WSS4J accepts attacker-controlled derived-key lengths and offsets without proper bounds checking, potentially leading to weak cryptographic keys or excessive resource consumption when processing crafted WS-Security messages.

Exploitability

Exploitation requires sending a specially crafted WS-Security message with malicious key parameters, but no preconditions are specified beyond the ability to send such messages.

Blast radius

If exploited, this vulnerability could cause high CPU and memory usage across affected systems, potentially leading to denial of service or degraded performance for legitimate users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache WSS4J version 4.0.2, 3.0.6, or 2.4.4 which contain the necessary fixes.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.