CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache WSS4Jto a version that resolves this vulnerability.Fixed in 4.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the StAX streaming WS-SecurityPolicy validator are affected when their policy uses certain relative or unsupported XPath expressions for required element protection.
What does an attacker need to do to exploit it?
A remote SOAP peer must send a SOAP message containing an element that policy requires to be signed or encrypted. Under the affected XPath handling, validation can fail to match that element path and allow the element without the expected protection.
What versions address the issue?
Upgrade Apache WSS4J to version 4.0.2, 3.0.6, or 2.4.4.