Threats affecting pkg:maven/Apache Software Foundation/org.apache.wss4j:wss4j-ws-security-policy-stax

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.1	EPSS 0.2%	CVE-2026-87830Apache WSS4J · Expression Language Injection Critical9.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-87830 CVE-2026-87830 is a critical vulnerability in Apache WSS4J's StAX streaming WS-SecurityPolicy validator. It allows certain relative or unsupported XPath expressions to bypass expected signature or encryption requirements in SOAP messages. This can lead to loss of confidentiality and integrity of these messages. The issue is fixed in versions 4.0.2, 3.0.6, and 2.4.4. EPSS 0.2%Vulnerability Apache Software Foundation CWE-917 #ghsa-66vg-36xv-j6x4	CVE Database V5	2026-09-30

Page 1 of 1