CVE-2026-89238 — Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

CVE-2026-89238

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection PUBLISHED

Description (CNA)

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache WSS4J	affected 4.0.0 before 4.0.2; affected 3.0.0 before 3.0.6; affected 0 before 2.4.4

CWE

No CWE identifiers supplied.

References

https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/30/11

CISA-ADP

No English description supplied.

No references supplied.