Linux Distros Unpatched Vulnerability : CVE-2026-85532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CP...

EUVD-2026-89791

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

PT-2026-103129

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 Description Apache WSS4J fails to properly validate bounds for derived-key lengths and offsets provided by a user. This flaw allows...