What is GHSA-66vg-36xv-j6x4?

GHSA-66vg-36xv-j6x4 is a security advisory published by GitHub Security Advisories with Critical severity. In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath...

Which CVE IDs does GHSA-66vg-36xv-j6x4 cover?

GHSA-66vg-36xv-j6x4 covers the following CVE IDs: CVE-2026-87830. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-66vg-36xv-j6x4?

GHSA-66vg-36xv-j6x4 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-66vg-36xv-j6x4CriticalCVSS 9.1

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-87830 →

📋 Description

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-87830
https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn
http://www.openwall.com/lists/oss-security/2026/09/30/9
https://github.com/advisories/GHSA-66vg-36xv-j6x4