CVE-2026-87830
Apache wss4j: expression language injection
- Risk score
- 62/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versi…
- Affected
- Apache wss4j before 4.0.2, 3.0.6, 2.4.4
- Fix
- Upgrade Apache wss4j to 4.0.2, 3.0.6 or 2.4.4 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Last activity 30 Sep 2026. Patch Forecast updates every hour.