# CVE-2026-95616: WSS4J integer overflow in DER bounds check

Source: https://junglewise.ai/threats/cve-2026-95616-an-integer-overflow-in-wss4j-s-der-bounds-check-lets-an-oversized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-95616 · Severity: high · CVSS 7.5 · Published 2026-09-30

WSS4J is a library used to add Web Services Security to SOAP messages, protecting them with XML signatures and encryption. An integer overflow vulnerability in its DER parsing allows an attacker to send a specially crafted SOAP message with a malicious X.509 certificate that triggers a massive 2 GB memory allocation, exhausting server memory through repeated requests. This denial-of-service attack requires no authentication and can crash vulnerable servers.

Technologies: [Apache WSS4J](https://junglewise.ai/threats/technologies/apache-wss4j). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-95616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95616 being exploited in the wild.

**How severe is CVE-2026-95616?** High severity, with a CVSS score of 7.5, published 30 September 2026.

**Which products and versions are affected?** Apache WSS4J Before 2.4.4, 3.0.x before 3.0.6, 4.0.x before 4.0.2.

**Is there a fix for CVE-2026-95616?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95616 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95616?** Check whether you run Apache WSS4J at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow in WSS4J's DER bounds check allows validation of oversized extension length declarations. An unauthenticated attacker sends a SOAP message with an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; the library decodes this during signature key reference resolution before message authentication, causing an eleven-byte extension to trigger a 2 GB memory allocation. Repeated requests exhaust server memory, resulting in denial of service.

## Affected products

- Apache WSS4J Before 2.4.4, 3.0.x before 3.0.6, 4.0.x before 4.0.2

## Timeline

- 2026-09-30: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct](https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct)

## Related threats

- [Apache WSS4J UsernameToken nonce replay vulnerability](https://junglewise.ai/threats/cve-2026-92899-apache-wss4j-remembers-the-nonce-of-each-usernametoken-it-accepts)
- [Apache WSS4J signature verification bypass in StAX code](https://junglewise.ai/threats/cve-2026-92121-in-the-wss4j-streaming-stax-code-a-signature-reference-using-the)
- [Apache WSS4J EncryptedHeader child confusion element promotion](https://junglewise.ai/threats/cve-2026-89238-wss4j-encryptedheader-child-confusion-could-promote-an-attacker)
- [Apache WSS4J authentication bypass in DOM security processor](https://junglewise.ai/threats/cve-2026-88920-an-authentication-bypass-in-the-dom-security-processor-in-apache)
- [Apache WSS4J derived-key bounds validation bypass](https://junglewise.ai/threats/cve-2026-85532-apache-wss4j-accepted-attacker-controlled-derived-key-lengths-and)