CVE-2015-0226: Apache WSS4J

High severity, CVSS 7.5. EPSS: 5.5% chance of exploitation in the next 30 days.

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

Affected products

• Apache WSS4J: up to and including 1.6.16; version 2.0 only; version 2.0.0 only; version 2.0.1 only

Published 2017-10-30. Last modified 2026-06-17.