CVE-2026-89238: Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache WSS4Jto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
Apache WSS4Jto a version that resolves this vulnerability.Fixed in 3.0.6 - Upgrade
Upgrade
Apache WSS4Jto a version that resolves this vulnerability.Fixed in 2.4.4
Event History
Frequently Asked Questions
Which WSS4J versions contain the fix?
The issue is fixed in WSS4J versions 4.0.2, 3.0.6, and 2.4.4. Upgrade to the applicable fixed release line.
What is the security impact if this issue is exploited?
An attacker-controlled plaintext element can be treated as the decrypted header. This can result in incorrect confidentiality coverage and may allow a security policy bypass.