{"id":"CVE-2026-95616","published":"2026-09-30T13:17:28.863","lastModified":"2026-10-06T17:21:33.233","description":"An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-190"],"vendors":["apache"],"products":["wss4j"],"references":[{"url":"https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/14","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"WSS4J's DER bounds check has an integer overflow that allows oversized memory allocations when processing X.509 certificates with malformed SubjectKeyIdentifier extensions. This can lead to memory exhaustion and denial of service attacks.","exploitability":"Exploitation is relatively straightforward as it requires only sending a specially crafted SOAP message with an oversized certificate extension, with no authentication needed.","blast_radius":"The impact could be significant across all systems using Apache WSS4J for SOAP message security, potentially causing widespread service disruption through memory exhaustion.","remediation":"Upgrade to Apache WSS4J version 4.0.2, 3.0.6, or 2.4.4 which contain the fix for this integer overflow vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","soap","memory-allocation","integer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:05:21.944Z"}}