Approved changes feed: RSS · Atom

cpe:2.3:a:spring:spring_web_services:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorSpring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc)
ProductSpring Web Services (2c0f2c1b-7c84-502c-bcc3-108ee340bdbe)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-41000 vulnerable 2026-07-29 00:49:30.836885 WSS4J validation does not use configured replay cache
LOW (3.7)
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:24.413Z
Updated: 2026-06-23T19:53:11.880Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-40999 vulnerable 2026-07-29 00:49:30.836663 Spring WS SSRF via unvalidated WS-Addressing reply destinations
HIGH (8.6)
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:17.009Z
Updated: 2026-06-23T19:52:42.934Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-40998 vulnerable 2026-07-29 00:49:30.836473 Jaxp13 XPath XXE via StreamSource and SAXSource
HIGH (8.2)
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:12.565Z
Updated: 2026-06-23T19:51:18.888Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-40997 vulnerable 2026-07-29 00:49:30.836135 SOAP security faults leak Spring Security account state
MEDIUM (5.3)
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:08.960Z
Updated: 2026-06-23T19:50:52.691Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-40996 vulnerable 2026-07-29 00:49:30.835745 Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
MEDIUM (4.8)
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:05.227Z
Updated: 2026-06-23T19:48:50.570Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-40995 vulnerable 2026-07-29 00:49:30.835442 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-40994 vulnerable 2026-07-29 00:49:30.834874 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-3773 vulnerable 2026-06-08 05:13:55.965814 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.