CVE-2026-89238: Vulnerability in Apache Software Foundation Apache WSS4J
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
AI Analysis
Technical Summary
CVE-2026-89238 describes a vulnerability in Apache Software Foundation's Apache WSS4J where an EncryptedHeader child confusion flaw can cause an attacker-controlled plaintext element to be treated as the decrypted header. This leads to incorrect confidentiality coverage and possible policy bypass. The vulnerability affects versions >=4.0.0 <4.0.2, >=3.0.0 <3.0.6, and >=0 <2.4.4. Upgrading to versions 4.0.2, 3.0.6, or 2.4.4 mitigates the issue.
Potential Impact
The vulnerability allows an attacker to bypass confidentiality protections by substituting a plaintext element as the decrypted header, which could lead to sensitive data exposure or policy circumvention. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Users should upgrade Apache WSS4J to version 4.0.2, 3.0.6, or 2.4.4 or later to remediate this vulnerability. These versions contain the official fixes for the issue.
CVE-2026-89238: Vulnerability in Apache Software Foundation Apache WSS4J
Description
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected software
Apache Software Foundation
Apache WSS4J
pkg:maven/Apache Software Foundation/org.apache.wss4j:wss4j-ws-security-domRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89238 describes a vulnerability in Apache Software Foundation's Apache WSS4J where an EncryptedHeader child confusion flaw can cause an attacker-controlled plaintext element to be treated as the decrypted header. This leads to incorrect confidentiality coverage and possible policy bypass. The vulnerability affects versions >=4.0.0 <4.0.2, >=3.0.0 <3.0.6, and >=0 <2.4.4. Upgrading to versions 4.0.2, 3.0.6, or 2.4.4 mitigates the issue.
Potential Impact
The vulnerability allows an attacker to bypass confidentiality protections by substituting a plaintext element as the decrypted header, which could lead to sensitive data exposure or policy circumvention. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Users should upgrade Apache WSS4J to version 4.0.2, 3.0.6, or 2.4.4 or later to remediate this vulnerability. These versions contain the official fixes for the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-11T10:07:05.047Z
- State
- PUBLISHED
Threat ID: 6abd07622a4e24523d03fb2a
Added to database: 09/30/2026, 12:58:10 UTC
Last enriched: 09/30/2026, 13:03:23 UTC
Last updated: 09/30/2026, 13:12:35 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.