Apache WSS4J accepts attacker‑controlled derived‑key lengths and offsets with insufficient bounds checking. The flaw allows crafting of WS‑Security messages that produce cryptographically weak keys or trigger high CPU and memory usage. According to CWE‑20, improper input validation can lead to weakened encryption or denial of service. The impact includes compromised encryption strength and potential service disruption due to resource exhaustion.

The affected component is the Apache WSS4J library from the Apache Software Foundation. Versions 2.4.4, 3.0.6, and 4.0.2 contain the vulnerability. These releases provide libraries for Java‑based web services that handle WS‑Security. All deployments that embed these specific versions are at risk until the fixes are applied.

The CVSS score is 7.5, indicating a high severity vulnerability that permits significant resource consumption and weak encryption, which can be critical for applications requiring high security and uptime. EPSS is unavailable, and the issue is not listed in the CISA KEV catalog; however, the lack of bounds checking suggests a high likelihood of exploitation if an attacker can send crafted messages. The official fix enforces minimum and maximum key lengths and offsets, mitigating both cryptographic and DoS aspects.