An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. (CVE-2026-95616)

CVE-2026-95616 describes an integer overflow in the DER bounds check of WSS4J's processing of the SubjectKeyIdentifier extension in X.509 certificates. An unauthenticated attacker can send a SOAP message with a certificate declaring an excessively large length (0x7FFFFFFF) for this extension. WSS4J decodes this length while resolving the signature's key reference before authenticating the message, causing an 11-byte extension to trigger a 2 GB memory allocation. Repeated exploitation can exhaust server memory, resulting in denial of service. The vulnerability is fixed in WSS4J versions 4.0.2, 3.0.6, and 2.4.4.

The vulnerability allows unauthenticated attackers to cause a denial of service by exhausting server memory through repeated requests with maliciously crafted certificates. There is no impact on confidentiality or integrity reported. The CVSS 3.1 score is 7.5 (High), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and an impact limited to availability.

Users should upgrade WSS4J to versions 4.0.2, 3.0.6, or 2.4.4, which contain fixes for this integer overflow vulnerability. Applying these official patches will prevent the oversized memory allocation and associated denial of service. No other mitigations are specifically recommended by the vendor advisory.