Spring Web Services
Approved changes feed: RSS · Atom
cpe:2.3:a:spring:spring_web_services:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc) |
|---|---|
| Product | Spring Web Services (2c0f2c1b-7c84-502c-bcc3-108ee340bdbe) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41000 |
vulnerable | 2026-07-29 00:49:30.836885 |
WSS4J validation does not use configured replay cache
LOW (3.7)
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:24.413Z
Updated: 2026-06-23T19:53:11.880Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40999 |
vulnerable | 2026-07-29 00:49:30.836663 |
Spring WS SSRF via unvalidated WS-Addressing reply destinations
HIGH (8.6)
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:17.009Z
Updated: 2026-06-23T19:52:42.934Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40998 |
vulnerable | 2026-07-29 00:49:30.836473 |
Jaxp13 XPath XXE via StreamSource and SAXSource
HIGH (8.2)
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:12.565Z
Updated: 2026-06-23T19:51:18.888Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40997 |
vulnerable | 2026-07-29 00:49:30.836135 |
SOAP security faults leak Spring Security account state
MEDIUM (5.3)
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:08.960Z
Updated: 2026-06-23T19:50:52.691Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40996 |
vulnerable | 2026-07-29 00:49:30.835745 |
Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
MEDIUM (4.8)
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Published: 2026-06-11T05:04:05.227Z
Updated: 2026-06-23T19:48:50.570Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40995 |
vulnerable | 2026-07-29 00:49:30.835442 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40994 |
vulnerable | 2026-07-29 00:49:30.834874 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3773 |
vulnerable | 2026-06-08 05:13:55.965814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.