An integer overflow in WSS4J’s DER bounds check allows an unauthenticated attacker to send a SOAP message containing an X.509 certificate with a SubjectKeyIdentifier extension length of 0x7FFFFFFF. WSS4J decodes this extension while resolving a signature key reference, before any authentication takes place, and allocates an 2 GB buffer. Repeated requests exhaust server memory, resulting in a denial of service.

The vulnerability affects Apache WSS4J versions prior to 4.0.2, 3.0.6, and 2.4.4. Any deployment using these older releases is exposed. The fix is applied in the listed newer versions.

The attack requires only network access and no authentication; the exploit path is straightforward enough to be automated. Although the EPSS score is not available, the impact of exhausting memory is significant, and the vulnerability is not listed in CISA’s KEV catalog. The primary risk is a remote denial of service that can be triggered by a single malformed SOAP request, potentially affecting all users of the vulnerable WSS4J instance.