CVE-2015-0226 Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

What is CVE-2015-0226?

CVE-2015-0226 is a high-severity vulnerability in n/a, published on 30 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

Weakness: CWE-327

Which versions are affected by CVE-2015-0226?

4 open source packages ship an affected version, including org.apache.ws.security:wss4j and org.apache.wss4j:wss4j-ws-security-dom. It affects 1 product.

Products include Apache Wss4j.

How do I fix CVE-2015-0226?

Upgrade org.apache.ws.security:wss4j to 1.6.17 or later.

Is CVE-2015-0226 being exploited?

There is no known exploitation of CVE-2015-0226 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-88920 Apache WSS4J: SAML Sender-Vouches Authentication Bypass Critical 9.8
• CVE-2026-87830 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. Critical 9.1
• CVE-2026-89238 Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection Critical 9.1
• CVE-2026-85532 Apache WSS4J: Insufficient Validation of Derived-Key Parameters High 7.5
• CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-0226, GHSA-vjwc-5hfh-2vv5.