{"schemaVersion":3,"id":"CVE-2026-92121","aliases":["UBUNTU-CVE-2026-92121","DEBIAN-CVE-2026-92121"],"status":"published","duplicateOf":null,"title":null,"description":"In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal \"inside signed content\" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.","dates":{"published":"2026-09-30T12:01:55.697Z","modified":"2026-09-30T19:51:55.272Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00548,"percentile":0.4476,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-01T00:00:00.000Z","score":0.0038,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00548,"percentile":0.4476}],"last30":[{"date":"2026-10-01T00:00:00.000Z","score":0.0038,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00349,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00548,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00548,"percentile":0.4476}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-693","name":"Protection Mechanism Failure","description":"The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.","type":"weakness","status":"Draft","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/693.html"}],"affected":[{"vendor":"apache software foundation","product":"apache wss4j","name":"Apache WSS4J","label":"apache wss4j","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.0.0, < 4.0.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, < 3.0.6","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.0.0, < 4.0.2 | ≥ 3.0.0, < 3.0.6 | < 2.4.4","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_wss4j"},{"vendor":"apache","product":"wss4j","name":"wss4j","label":"wss4j","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.4.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, < 3.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.0.0, < 4.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.4 | ≥ 3.0.0, < 3.0.6 | ≥ 4.0.0, < 4.0.2","eol":null,"hubHref":"/vendor/apache/wss4j"},{"vendor":"debian","product":"wss4j","name":"wss4j","label":"wss4j","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/wss4j","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"wss4j","name":"wss4j","label":"wss4j","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/wss4j","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc","label":"lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/12","label":"www.openwall.com/lists/oss-security/2026/09/30/12","hostname":"www.openwall.com","tags":["REPORT","Mailing List","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-92121","label":"ubuntu.com/security/CVE-2026-92121","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92121","label":"www.cve.org/CVERecord?id=CVE-2026-92121","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-92121","label":"security-tracker.debian.org/tracker/CVE-2026-92121","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-30T12:01:55.697Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-30T19:51:55.272Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T17:37:41.039Z","stale":false,"partial":false}}