dev@ws.apache.org, 2026-09

You are viewing a plain text version of this content. The canonical link for it is here.

- Re: [PR] Bump actions/setup-java from 5.7.0 to 6.0.0 [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 06:54:48 UTC, 0 replies.
- Re: [PR] Bump github/codeql-action/analyze from 4.37.8 to 4.37.9 [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 06:55:06 UTC, 0 replies.
- Re: [PR] Bump actions/setup-java from 5.7.0 to 6.0.0 [ws-neethi] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 06:55:32 UTC, 0 replies.
- Re: [PR] Bump github/codeql-action/init from 4.37.8 to 4.37.9 [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 06:55:36 UTC, 0 replies.
- Re: [PR] Bump github/codeql-action/init from 4.37.8 to 4.37.9 [ws-neethi] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 06:55:54 UTC, 0 replies.
- Re: [PR] Bump github/codeql-action/analyze from 4.37.8 to 4.37.9 [ws-neethi] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 06:56:21 UTC, 0 replies.
- [PR] Group codeql updates [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:18:03 UTC, 1 replies.
- [PR] Group codeql updates [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:24:10 UTC, 1 replies.
- [PR] Group codeql updates [ws-neethi] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:24:17 UTC, 1 replies.
- Re: [PR] Bump github/codeql-action/analyze from 4.37.7 to 4.37.9 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:25:17 UTC, 0 replies.
- Re: [PR] Bump actions/setup-java from 5.7.0 to 6.0.0 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:25:28 UTC, 0 replies.
- Re: [PR] Bump github/codeql-action/init from 4.37.7 to 4.37.9 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:25:42 UTC, 0 replies.
- Re: [PR] Bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.9 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/01 07:25:51 UTC, 0 replies.
- [PR] Enforce signature protection as well for SOAP 12 streaming [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/02 14:41:08 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/03 03:52:50 UTC, 1 replies.
- [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/03 03:53:13 UTC, 1 replies.
- [PR] Put a lower bound of 16 bytes on minimum derived key length [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/03 09:01:13 UTC, 1 replies.
- [PR] Enable and fix derived key WS-SecurityPolicy validation in the DOM code [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/03 15:48:36 UTC, 1 replies.
- [PR] Bump surefire.version from 3.5.6 to 3.6.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/04 03:55:33 UTC, 1 replies.
- Re: [PR] Use provider-neutral X.509 key identifier parsing [ws-wss4j] - posted by "gregjotau (via GitHub)" <gi...@apache.org> on 2026/09/04 05:11:02 UTC, 1 replies.
- [PR] Put a max bound on Derived Key offset + length [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/04 06:08:08 UTC, 1 replies.
- [PR] Fix a potential NPE with HSM based Crypto instances in the derived ke… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/04 06:41:38 UTC, 1 replies.
- [jira] [Commented] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) - posted by "Ivan Novak (Jira)" <ji...@apache.org> on 2026/09/04 07:57:00 UTC, 0 replies.
- [PR] Align StAX security header processing with the DOM code [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/04 09:55:22 UTC, 1 replies.
- [PR] Only set the StAX RSA 1.5 + UsernameToken No Password properties if w… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/04 16:05:27 UTC, 1 replies.
- [PR] Harden XML parsing via commons-secure-xml [ws-wss4j] - posted by "garydgregory (via GitHub)" <gi...@apache.org> on 2026/09/06 16:02:28 UTC, 8 replies.
- [PR] Bump checkerframework.version from 4.2.2 to 4.2.3 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/07 03:52:55 UTC, 1 replies.
- Re: [PR] Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/07 08:36:00 UTC, 0 replies.
- Re: [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/07 08:36:11 UTC, 0 replies.
- [PR] Enforce isAllowRSA15KeyTransportAlgorithm for the StAX layer [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/07 09:24:21 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 [ws-xmlschema] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/07 17:33:08 UTC, 1 replies.
- Re: [PR] Bump com.fasterxml.woodstox:woodstox-core from 7.1.1 to 7.2.2 [ws-wss4j] - posted by "garydgregory (via GitHub)" <gi...@apache.org> on 2026/09/07 19:51:25 UTC, 3 replies.
- [PR] Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/08 03:52:35 UTC, 1 replies.
- [PR] Bump org.slf4j:slf4j-bom from 2.0.18 to 2.0.19 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/08 03:52:48 UTC, 1 replies.
- [PR] Bump groovy.version from 5.1.1 to 5.1.2 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/08 03:53:02 UTC, 1 replies.
- [PR] Bump jetty.version from 12.1.12 to 12.1.13 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/08 03:53:35 UTC, 1 replies.
- [PR] Bump org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/08 08:02:59 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/08 08:03:10 UTC, 2 replies.
- [PR] Reject mismatched symmetric key lengths to prevent cross-algorithm ke… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/08 09:40:31 UTC, 1 replies.
- [PR] Check the SOAPAction matches the body for the StAX policy case [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/08 15:13:12 UTC, 1 replies.
- [PR] Add security documentation for StAX [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/09 05:57:35 UTC, 1 replies.
- [PR] Correct XOP javadoc [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/09 06:18:41 UTC, 1 replies.
- [PR] Bump com.puppycrawl.tools:checkstyle from 12.3.1 to 14.1.0 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/09 09:19:33 UTC, 3 replies.
- [PR] Fix issues with SignedElements / EncryptedElements [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/09 10:59:02 UTC, 1 replies.
- [jira] [Created] (WSS-729) Switch default JasyptPasswordEncryptor algorithm to something secure - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/09 13:45:00 UTC, 0 replies.
- [PR] WSS-729 Switch default JasyptPasswordEncryptor algorithm to PBEWithHm… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/09 15:00:15 UTC, 1 replies.
- [PR] Bump slf4j.version from 2.0.18 to 2.0.19 [ws-xmlschema] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/09 20:46:26 UTC, 1 replies.
- [jira] [Resolved] (WSS-729) Switch default JasyptPasswordEncryptor algorithm to something secure - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/10 06:00:00 UTC, 0 replies.
- [PR] Reject duplicate C14N settings + Detect unknown top-level policy asse… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/10 08:37:07 UTC, 1 replies.
- [PR] Fix sender-vouches signature referencing [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/10 10:24:54 UTC, 1 replies.
- [PR] Make sure we can't register a fake SOAP Body for lookup [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/10 16:16:38 UTC, 1 replies.
- [PR] EncryptedHeader child confusion causing wrong protected-header selection [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/11 10:10:15 UTC, 1 replies.
- [jira] [Created] (AXIOM-530) Detect the StAX dialect from factory properties instead of the factory class - posted by "Piotr Karwasz (Jira)" <ji...@apache.org> on 2026/09/13 13:09:00 UTC, 0 replies.
- [PR] AXIOM-530: Detect the StAX dialect from factory properties [ws-axiom] - posted by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/09/13 13:29:08 UTC, 0 replies.
- [jira] [Commented] (AXIOM-530) Detect the StAX dialect from factory properties instead of the factory class - posted by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2026/09/13 13:30:00 UTC, 0 replies.
- [PR] Bump mime4j.version from 0.8.14 to 0.8.15 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 03:52:50 UTC, 0 replies.
- [PR] Bump org.eclipse.platform:org.eclipse.osgi from 3.24.200 to 3.24.300 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 03:53:00 UTC, 0 replies.
- [PR] Bump maven-plugin-tools.version from 3.15.2 to 3.16.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 03:53:19 UTC, 0 replies.
- [PR] Make sure for Attachment-Complete the mime type is read from the encr… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/14 06:52:30 UTC, 1 replies.
- [PR] Harden Loader to only load from file + jar by default [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/14 11:18:56 UTC, 2 replies.
- [PR] Improving docs for subject cert constraint [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/14 13:57:23 UTC, 1 replies.
- [PR] Bump the codeql-action group with 2 updates [ws-neethi] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 17:16:09 UTC, 5 replies.
- [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-neethi] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 17:16:27 UTC, 1 replies.
- [PR] Bump the codeql-action group with 2 updates [ws-xmlschema] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 17:34:42 UTC, 5 replies.
- [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-xmlschema] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/14 17:34:51 UTC, 1 replies.
- [PR] Bump org.codehaus.mojo:tidy-maven-plugin from 1.4.0 to 1.4.1 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/15 03:53:10 UTC, 1 replies.
- [PR] Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/15 03:53:29 UTC, 1 replies.
- [VOTE] - Release Apache Neethi 3.2.4 - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/15 11:25:39 UTC, 5 replies.
- [PR] Fix bug with signature policy validation for STR Transform [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/15 16:20:37 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 03:53:28 UTC, 1 replies.
- Re: [PR] Bump jakarta.servlet:jakarta.servlet-api from 5.0.0 to 6.0.0 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 05:00:28 UTC, 0 replies.
- Re: [PR] Bump com.google.errorprone:error_prone_core from 2.38.0 to 2.50.0 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 05:01:57 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:06:35 UTC, 2 replies.
- [PR] Bump slf4j.version from 2.0.18 to 2.0.19 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:06:55 UTC, 1 replies.
- [PR] Bump bcprov.version from 1.84 to 1.86 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:07:03 UTC, 3 replies.
- [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:07:09 UTC, 1 replies.
- [PR] Bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:07:43 UTC, 1 replies.
- [PR] Bump the codeql-action group with 3 updates [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:10:00 UTC, 3 replies.
- [PR] Bump actions/setup-java from 6.0.0 to 6.0.1 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/16 08:10:13 UTC, 1 replies.
- [PR] Fix up DTD handling [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 08:37:30 UTC, 1 replies.
- [PR] Restrict default protocols allowed by the DefaultURIResolver [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 09:14:13 UTC, 1 replies.
- [PR] Updating docs for remote URI dereferencing [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 09:49:44 UTC, 1 replies.
- [PR] Exclude a few other things by default in DefaultURIResolver [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 10:19:43 UTC, 1 replies.
- [PR] Fix some potential NPEs [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/16 13:59:12 UTC, 1 replies.
- Build failed in Jenkins: webservices » Apache WSS4J - 2.3.x-fixes JDK 8 #42 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/16 17:20:25 UTC, 0 replies.
- [PR] Fix signature replay caching [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 05:42:56 UTC, 1 replies.
- [PR] Place default limits on read timeouts + size on remote schemas [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 06:08:33 UTC, 1 replies.
- [PR] Fix scchema resolution budget bug [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 06:53:13 UTC, 1 replies.
- [PR] Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 08:03:05 UTC, 1 replies.
- [PR] Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 08:04:36 UTC, 1 replies.
- [PR] Bump org.apache:apache from 37 to 39 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 08:05:51 UTC, 1 replies.
- [PR] Fix StAX replaycache tests [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 08:21:14 UTC, 1 replies.
- [PR] Keep document-walk failures distinguishable [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 08:24:35 UTC, 1 replies.
- [PR] Report unresolvable and complex-where-simple type references as XmlSc… [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 08:36:40 UTC, 1 replies.
- [PR] Fix nonce encoding issue [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 09:08:12 UTC, 1 replies.
- [PR] Serialize notation as well and fix some NPEs [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 09:10:35 UTC, 1 replies.
- [PR] Stop capturing foreign children of the document element [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 09:17:33 UTC, 1 replies.
- [PR] Add a switch to allow network resolution to be turned off [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 10:19:38 UTC, 1 replies.
- [PR] Add a new property to disable reading local files [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/17 12:24:34 UTC, 1 replies.
- [PR] Only set trust validation for Signature when we have a trusted source [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 08:47:19 UTC, 1 replies.
- [PR] Adding docs about trust credentials for BST [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 09:36:35 UTC, 1 replies.
- [PR] Putting max on UsernameToken stax iterations [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 10:31:58 UTC, 1 replies.
- [PR] Set trust when there is no KeyInfo and the certificate comes from a l… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 10:52:08 UTC, 1 replies.
- [PR] Additional Bleichenbacher fix [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 14:20:48 UTC, 2 replies.
- [PR] Updating Neethi to 3.2.4 [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 15:05:39 UTC, 1 replies.
- CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:28:04 UTC, 0 replies.
- CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:29:51 UTC, 0 replies.
- CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:30:31 UTC, 0 replies.
- CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:30:57 UTC, 0 replies.
- CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:31:27 UTC, 0 replies.
- [PR] Redact passwords from UsernameToken toString [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/18 16:23:37 UTC, 1 replies.
- [PR] Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 in /parent [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/18 18:39:28 UTC, 3 replies.
- [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/21 03:53:06 UTC, 0 replies.
- [PR] Bound the encrypted data nesting depth [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 06:22:28 UTC, 2 replies.
- [PR] Document streaming policy enforcement [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 06:26:16 UTC, 1 replies.
- [PR] Stricter policy enforcement [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 06:50:30 UTC, 1 replies.
- [PR] Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/21 08:06:03 UTC, 1 replies.
- [PR] Properly wire UsernameToken + RSA15 flags for the streaming layer [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 08:24:37 UTC, 1 replies.
- [PR] Fix SenderVouches EncryptedKey case [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 08:50:39 UTC, 1 replies.
- [PR] Extend the EncryptedKey random-key fallback beyond decryptDataRef [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 09:05:49 UTC, 1 replies.
- [PR] Align StaX sender vouches with DOM layer [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 10:00:12 UTC, 1 replies.
- [PR] Fix SAML Conditions parsing [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 10:22:10 UTC, 1 replies.
- [PR] Fix timestamp parsing [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 11:30:57 UTC, 1 replies.
- [PR] Update certs that are failing with the Bouncycastle update [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 11:58:46 UTC, 1 replies.
- [PR] StAX SAML subject confirmation skipped for an empty SOAP Body [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 13:09:17 UTC, 1 replies.
- [PR] Switch to use BASE-64 encoding rather than 32 bit hash values for sig… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 14:02:02 UTC, 1 replies.
- Re: [PR] Remove Bouncy Castle from X.509 key identifier parsing [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 14:29:20 UTC, 1 replies.
- [PR] Follow-on from last DER patch [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/21 15:17:19 UTC, 3 replies.
- [PR] Bump org.xmlunit:xmlunit-assertj3 from 2.13.0 to 2.14.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/22 03:53:10 UTC, 1 replies.
- [jira] [Updated] (WSS-416) Update ConditionsBean to support additional conditions such as Delegate - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 06:44:00 UTC, 0 replies.
- [jira] [Updated] (WSS-721) Merlin Trust Optimization Request - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 06:44:00 UTC, 0 replies.
- [jira] [Updated] (WSS-713) Support SubjectConfirmationData for SAML-SV v1 - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 06:44:00 UTC, 0 replies.
- [jira] [Resolved] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 06:56:00 UTC, 0 replies.
- [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 06:56:00 UTC, 0 replies.
- [jira] [Closed] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 06:57:00 UTC, 0 replies.
- [PR] Finishing DER work [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/22 08:46:19 UTC, 2 replies.
- [PR] Xop hardening fix [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/22 10:29:46 UTC, 1 replies.
- [jira] [Updated] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 10:56:00 UTC, 0 replies.
- [jira] [Work started] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 10:56:00 UTC, 0 replies.
- [PR] Fixing AKI bug [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/22 10:56:35 UTC, 1 replies.
- Re: [PR] WSS-727 Do not cache SwA attachment References when verifying a Signature [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/22 11:03:05 UTC, 1 replies.
- Re: Woden source repo - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/22 11:04:19 UTC, 1 replies.
- [PR] WSS-727 - Minor cleanup [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/22 11:15:03 UTC, 1 replies.
- [jira] [Resolved] (WSS-727) SignatureProcessor retains the entire attachment in heap when verifying an SwA signed attachment (cacheReference) - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/09/22 12:51:00 UTC, 0 replies.
- Jenkins build became unstable: webservices » Apache WSS4J - master JDK17 » Apache WSS4J WS-Security Common #162 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/22 16:20:08 UTC, 0 replies.
- Jenkins build became unstable: webservices » Apache WSS4J - master JDK17 #162 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/22 16:20:09 UTC, 0 replies.
- [jira] [Created] (WSS-730) Add post-quantum cryptography (ML-DSA / ML-KEM) support - posted by "Freeman Yue Fang (Jira)" <ji...@apache.org> on 2026/09/22 20:24:00 UTC, 0 replies.
- [PR] WSS4J messages now render correctly even if Santuario is never initia… [ws-wss4j] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/23 06:54:19 UTC, 1 replies.
- [PR] Bump org.apache:apache from 39 to 40 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/23 08:45:09 UTC, 1 replies.
- [VOTE] - Release Apache WSS4J 4.0.2, 3.0.6, 2.4.4 - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/23 12:36:12 UTC, 3 replies.
- Jenkins build is back to stable : webservices » Apache WSS4J - master JDK17 » Apache WSS4J WS-Security Common #163 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/23 16:20:11 UTC, 0 replies.
- Jenkins build is back to stable : webservices » Apache WSS4J - master JDK17 #163 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/23 16:20:11 UTC, 0 replies.
- [PR] Bump org.apache:apache from 39 to 40 [ws-neethi] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/23 17:53:14 UTC, 1 replies.
- [PR] Bump org.apache:apache from 39 to 40 [ws-xmlschema] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/23 18:02:07 UTC, 1 replies.
- [PR] inherit the substitution group head's type for untyped elements [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 05:23:53 UTC, 1 replies.
- Re: [PR] Fix bugs regarding substitution groups and content extensions using xs:all [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 05:24:42 UTC, 1 replies.
- [PR] Walker: bound the depth of an acyclic schema walk [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 05:50:32 UTC, 1 replies.
- [PR] Add a bound on the number of redirects the DefaultURIResolver can do [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 06:03:32 UTC, 1 replies.
- [PR] Adding new org.apache.ws.commons.schema.remote.checkAddresses property [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 06:38:32 UTC, 1 replies.
- [PR] Bump xmlunit.version from 2.13.0 to 2.14.0 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/24 08:03:33 UTC, 1 replies.
- [PR] Make sure file references are to actual files [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 09:04:52 UTC, 1 replies.
- [PR] Bound the nesting depth of annotation markup [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 09:53:51 UTC, 1 replies.
- [PR] Check that a relative schema location is a regular file [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 09:56:38 UTC, 1 replies.
- [PR] Collect ancestor prefix declarations without recursion [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 10:01:10 UTC, 1 replies.
- [PR] Misc fixes [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 10:13:42 UTC, 3 replies.
- [PR] Allow an xs:all alongside an empty particle in a complex content exte… [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 10:48:10 UTC, 1 replies.
- [PR] Fix the path finder refusing or failing on common valid documents [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 11:00:52 UTC, 1 replies.
- [PR] Do not declare an empty prefix for an unhandled attribute value [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 11:06:00 UTC, 1 replies.
- [PR] Keep complexType block, union members and keyref refer through read a… [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 11:26:25 UTC, 1 replies.
- [PR] Check the file the parser opens for a relative schema location [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 11:37:52 UTC, 1 replies.
- [PR] Fix jarFileUrlIsAllowedByDefault test on Windows [ws-wss4j] - posted by "beth-soptim (via GitHub)" <gi...@apache.org> on 2026/09/24 12:55:54 UTC, 0 replies.
- [PR] Read "1" and surrounding whitespace as true for xs:boolean attributes [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 13:49:28 UTC, 1 replies.
- [PR] Do not build a wire name for an element or attribute with no name [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 14:06:43 UTC, 1 replies.
- [PR] [WSS-730]Add post-quantum (ML-DSA / ML-KEM) support to WSS4J [ws-wss4j] - posted by "ffang (via GitHub)" <gi...@apache.org> on 2026/09/24 15:32:43 UTC, 1 replies.
- [PR] Count a cached base type's whole derivation chain against the walk depth [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/24 15:46:05 UTC, 1 replies.
- [PR] Bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 [ws-neethi] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/24 17:14:20 UTC, 3 replies.
- [PR] Bound the element depth of the schema parse [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 05:15:58 UTC, 1 replies.
- [PR] Refuse an element declaration with no name and no ref in the walker [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 08:46:35 UTC, 1 replies.
- [PR] The walker changes the schema model [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 09:38:07 UTC, 1 replies.
- [PR] Limit entity expansion [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 10:06:20 UTC, 1 replies.
- [PR] Check a file: location relative to the working directory as a regular… [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 14:00:49 UTC, 1 replies.
- [PR] Close the connection when a remote fetch is refused before its body [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 14:07:51 UTC, 1 replies.
- [PR] Fix test on JDK8 [ws-xmlschema] - posted by "coheigea (via GitHub)" <gi...@apache.org> on 2026/09/25 15:10:08 UTC, 1 replies.
- [VOTE] - Release Apache XML Schema 2.3.3 - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/25 15:50:45 UTC, 3 replies.
- [PR] Bump slf4j.version from 2.0.19 to 2.0.20 [ws-wss4j] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/28 08:03:20 UTC, 1 replies.
- [PR] Bump slf4j.version from 2.0.19 to 2.0.20 [ws-xmlschema] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/28 18:12:54 UTC, 1 replies.
- [PR] Bump org.apache.maven.shared:maven-shared-utils from 3.4.2 to 3.5.0 [ws-axiom] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/29 03:52:53 UTC, 0 replies.
- [GH] (ws-axiom/master): Workflow run "maven in /. - Update #1597016513" failed! - posted by GitBox <gi...@apache.org> on 2026/09/29 03:54:22 UTC, 0 replies.
- CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/29 11:02:58 UTC, 0 replies.
- CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/29 11:03:17 UTC, 0 replies.
- CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/29 11:03:26 UTC, 0 replies.
- [GH] (ws-axiom/master): Workflow run "github_actions in /. - Update #1599279213" is working again! - posted by GitBox <gi...@apache.org> on 2026/09/30 03:52:35 UTC, 0 replies.
- CVE-2026-85532: Apache WSS4J: Insufficient Validation of Derived-Key Parameters - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:28:17 UTC, 0 replies.
- CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:29:52 UTC, 0 replies.
- CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:31:52 UTC, 0 replies.
- CVE-2026-89238: Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:34:05 UTC, 0 replies.
- CVE-2026-92121: Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:36:24 UTC, 0 replies.
- CVE-2026-92899: Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:37:31 UTC, 0 replies.
- CVE-2026-95616: Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:38:57 UTC, 0 replies.
- Build failed in Jenkins: webservices » Apache WSS4J - master JDK17 #164 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/30 16:21:42 UTC, 0 replies.
- Build failed in Jenkins: webservices » Apache WSS4J - 2.4.x-fixes JDK 11 #36 - posted by Apache Jenkins Server <je...@builds.apache.org> on 2026/09/30 21:02:33 UTC, 0 replies.
- [PR] Reproduce StAX SignedElements policy rejects a SAML assertion signed through STR-Transform [ws-wss4j] - posted by "ppalaga-agent (via GitHub)" <gi...@apache.org> on 2026/09/30 22:36:15 UTC, 0 replies.
- [jira] [Created] (WSS-731) StAX SignedElements policy rejects a SAML assertion signed through STR-Transform - posted by "Peter Palaga (Jira)" <ji...@apache.org> on 2026/09/30 22:38:00 UTC, 0 replies.
- [jira] [Updated] (WSS-731) StAX SignedElements policy rejects a SAML assertion signed through STR-Transform - posted by "Peter Palaga (Jira)" <ji...@apache.org> on 2026/09/30 22:41:00 UTC, 1 replies.