Is CVE-2026-95616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95616 being exploited in the wild.

How severe is CVE-2026-95616?

High severity, with a CVSS score of 7.5, published 30 September 2026.

Which products and versions are affected?

Apache WSS4J Before 2.4.4, 3.0.x before 3.0.6, 4.0.x before 4.0.2.

Is there a fix for CVE-2026-95616?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95616 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95616?

Check whether you run Apache WSS4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95616: WSS4J integer overflow in DER bounds check

CVE-2026-95616 · Severity: high · CVSS 7.5 · Published 2026-09-30

WSS4J is a library used to add Web Services Security to SOAP messages, protecting them with XML signatures and encryption. An integer overflow vulnerability in its DER parsing allows an attacker to send a specially crafted SOAP message with a malicious X.509 certificate that triggers a massive 2 GB memory allocation, exhausting server memory through repeated requests. This denial-of-service attack requires no authentication and can crash vulnerable servers.

Technologies: Apache WSS4J. Vendors: Apache.

Quick answers

Is CVE-2026-95616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95616 being exploited in the wild.
How severe is CVE-2026-95616?: High severity, with a CVSS score of 7.5, published 30 September 2026.
Which products and versions are affected?: Apache WSS4J Before 2.4.4, 3.0.x before 3.0.6, 4.0.x before 4.0.2.
Is there a fix for CVE-2026-95616?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95616 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95616?: Check whether you run Apache WSS4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow in WSS4J's DER bounds check allows validation of oversized extension length declarations. An unauthenticated attacker sends a SOAP message with an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; the library decodes this during signature key reference resolution before message authentication, causing an eleven-byte extension to trigger a 2 GB memory allocation. Repeated requests exhaust server memory, resulting in denial of service.

Affected products

Apache WSS4J Before 2.4.4, 3.0.x before 3.0.6, 4.0.x before 4.0.2

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.