Vulnerability · Published Sep 30, 2026 · Assigned by apache
CVE-2026-85532Apache WSS4J: Insufficient Validation of Derived-Key Parameters
High 7.5
In plain English
A high-severity improper input validation in Apache WSS4J from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | wss4j | no fix listed | DEBIAN-CVE-2026-85532 |
| Debian:13 | wss4j | no fix listed | DEBIAN-CVE-2026-85532 |
| Debian:14 | wss4j | no fix listed | DEBIAN-CVE-2026-85532 |
| Ubuntu:22.04:LTS | wss4j | no fix listed | UBUNTU-CVE-2026-85532 |
| Ubuntu:24.04:LTS | wss4j | no fix listed | UBUNTU-CVE-2026-85532 |
| Ubuntu:26.04:LTS | wss4j | no fix listed | UBUNTU-CVE-2026-85532 |
| Ubuntu:26.10 | wss4j | no fix listed | UBUNTU-CVE-2026-85532 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache WSS4J | 4.0.0 – before 4.0.23.0.0 – before 3.0.60 – before 2.4.4 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H