Security · VMware Spring Web Services

New Spring Web Services Flaws Disclosed Alongside Legacy XXE Advisory

·

Spring Web Services is affected by CVE-2026-40998, where Jaxp13XPathTemplate evaluates XPath on StreamSource and SAXSource inputs using the JDK's default DocumentBuilderFactory rather than Spring's hardened parser, exposing applications to XML External Entity (XXE) attacks, and CVE-2026-40994, where Wss4jSecurityInterceptor disables WSS4J WS-I Basic Security Profile enforcement during inbound validation, allowing non-compliant messages to be accepted; affected versions are 5.0.0–5.0.1, 4.1.0–4.1.3, 4.0.0–4.0.18 and 3.1.0–3.1.8. These follow the earlier CVE-2019-3773 advisory, in which Spring Web Services 2.4.3, 3.0.4 and older unsupported versions were susceptible to XXE when processing XML from untrusted sources.

Related coverage