Threats affecting pkg:maven/Apache Software Foundation/org.apache.wss4j:wss4j-ws-security-stax

CVE-2026-92121 is a vulnerability in Apache WSS4J's streaming (StAX) code where a signature reference using the WS-Security STR-Transform causes an internal flag to remain set incorrectly. This leads the WS-SecurityPolicy enforcer to stop verifying signed parts for the remainder of the message, allowing a policy requiring the SOAP Body to be signed to be falsely satisfied even if the Body is unsigned. The DOM code is not affected. Versions 4.0.2, 3.0.6, and 2.4.4 include fixes for this issue.