CVE-2026-95616

7.5 HIGH

Published 2026-09-30 · Updated 2026-10-06

AI risk analysis

Summary: WSS4J's DER bounds check has an integer overflow that allows oversized memory allocations when processing X.509 certificates with malformed SubjectKeyIdentifier extensions. This can lead to memory exhaustion and denial of service attacks.
Exploitability: Exploitation is relatively straightforward as it requires only sending a specially crafted SOAP message with an oversized certificate extension, with no authentication needed.
Blast radius: The impact could be significant across all systems using Apache WSS4J for SOAP message security, potentially causing widespread service disruption through memory exhaustion.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Apache WSS4J version 4.0.2, 3.0.6, or 2.4.4 which contain the fix for this integer overflow vulnerability.

denial-of-servicesoapmemory-allocationinteger-overflow

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-190

Vendors

apache

Products

wss4j

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.