Critical
wss4j — security advisory
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
- Products
- wss4j
- Affected versions
- 1.6.15-2, 1.6.19-1, 1.6.19-2, 1.6.19-3, 1.6.19-4, 1.6.19-4build1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-89238
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:31 UTC · Revision 1
Source evidence
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
osv:UBUNTU-CVE-2026-89238
wss4j
Fixed versions: Not specified
wss4j
Fixed versions: Not specified
wss4j
Fixed versions: Not specified
wss4j
Fixed versions: Not specified
wss4j
Fixed versions: Not specified
wss4j
Fixed versions: Not specified
wss4j
Fixed versions: Not specified
Complete source record
{
"id": "a521282113ea6a6a491f789cb42dfdf84f6d4371bafd770f2a370c794e747643",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-89238",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-89238",
"summary": "WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.",
"evidence": "osv:UBUNTU-CVE-2026-89238",
"products": [
{
"name": {
"value": "wss4j",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.15-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "wss4j",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.19-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "wss4j",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.19-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "wss4j",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.19-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "wss4j",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.19-3",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "wss4j",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.19-4build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "wss4j",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6.19-4",
"evidence": "/affected/6/versions"
},
{
"value": "1.6.19-4build1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2026-89238",
"aliases": [
"UBUNTU-CVE-2026-89238"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.6.15-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.15-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.6.19-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.19-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.6.19-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.19-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.6.19-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.19-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.6.19-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.19-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.6.19-4build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.19-4build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wss4j",
"purl": "pkg:deb/ubuntu/wss4j?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.6.19-4",
"1.6.19-4build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-89238.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwss4j-java",
"binary_version": "1.6.19-4build1"
}
]
}
}
],
"modified": "2026-10-17T13:01:16.588701757Z",
"provider": "osv",
"upstream": [
"CVE-2026-89238"
],
"references": [
"https://ubuntu.com/security/CVE-2026-89238",
"https://www.cve.org/CVERecord?id=CVE-2026-89238",
"https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w"
]
},
"related_cves": [
{
"value": "CVE-2026-89238",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361464,
"published_at": "2026-09-30T13:17:00+00:00"
}