RHLW-2026-422078e03066e6ac

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-422078e03066e6ac.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-422078e03066e6ac.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-422078e03066e6ac
Upstream
  • CVE-2026-92121
Published
2026-10-22T09:14:50Z
Modified
2026-10-27T08:45:02Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Lightwell Security Advisory: wss4j-ws-security-stax 4.0.1.rhlw-00003
Details

Red Hat Lightwell has released org.apache.wss4j:wss4j-ws-security-stax 4.0.1.rhlw-00003 with a backported security fix.

CVE-2026-92121: In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected.  Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.

This patched artifact is a drop-in replacement for org.apache.wss4j:wss4j-ws-security-stax 4.0.1 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.wss4j:wss4j-ws-security-stax

Package

Name
org.apache.wss4j:wss4j-ws-security-stax
Purl
pkg:maven/org.apache.wss4j/wss4j-ws-security-stax

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.0.1.rhlw-00003

Affected versions

2.*
2.0-beta
2.0.0-rc1
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
4.*
4.0.0
4.0.1

Database specific

lightwell 
{
    "backport_base_version":  "4.0.1",
    "remediated_version":  "4.0.1.rhlw-00003",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-422078e03066e6ac.json"