Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: Spring Web Services 3.1.9, 4.0.19 and 2 more versions Clear all filters
TI-2026-29651 CVE-2026-41000 · GHSA-8qq9-r6cc-qjv9

WSS4J validation does not use configured replay cache

Priority LOW 17

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00223 Published 2026-06-11 Partial fix · 5.0.1.1, 4.1.3.1 +4 CWE-294
TI-2026-29650 CVE-2026-40999 · GHSA-whpp-xv3h-rwxf

Spring WS SSRF via unvalidated WS-Addressing reply destinations

Priority MEDIUM 43

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request hea…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00383 Published 2026-06-11 Fixed in 5.0.1.1, 4.1.3.1 +4 CWE-918
TI-2026-29649 CVE-2026-40998 · GHSA-2mpf-m756-hxjm

Jaxp13 XPath XXE via StreamSource and SAXSource

Priority MEDIUM 42

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's harde…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00352 Published 2026-06-11 Fixed in 5.0.1.1, 4.1.3.1 +4 CWE-611
TI-2026-29648 CVE-2026-40997 · GHSA-5x25-c2rf-f2jx

SOAP security faults leak Spring Security account state

Priority LOW 30

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instea…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00366 Published 2026-06-11 Fixed in 5.0.1.1, 4.1.3.1 +4 CWE-209
TI-2026-29647 CVE-2026-40996 · GHSA-p7qj-2q5w-f9r7

Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

Priority LOW 21

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00129 Published 2026-06-11 Fixed in 5.0.1.1, 4.1.3.1 +4 CWE-327
TI-2026-29646 CVE-2026-40995 · GHSA-6mfm-98wv-32wm

X.509 authentication bypasses Spring Security account checks

Priority LOW 23

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, loc…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00148 Published 2026-06-11 Fixed in 5.0.1.1, 4.1.3.1 +4 CWE-287
TI-2026-29645 CVE-2026-40994 · GHSA-gg9r-wr4p-w63h

Wss4jSecurityInterceptor disables WS-I BSP validation by default

Priority MEDIUM 41

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00229 Published 2026-06-11 Fixed in 5.0.1.1, 4.1.3.1 +4 CWE-1188