DEBIAN-CVE-2026-87830

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-87830

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87830.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-87830

Upstream

CVE-2026-87830

Published

2026-09-30T12:17:14Z

Modified

2026-10-07T09:47:32Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

References

https://security-tracker.debian.org/tracker/CVE-2026-87830

Affected packages

Debian:13 / wss4j

Package

Name: wss4j
Purl: pkg:deb/debian/wss4j?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.19-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87830.json"

Debian:14 / wss4j