Security · VMware Spring Web Services
New Spring Web Services Flaws Disclosed Alongside Legacy XXE Advisory
Spring Web Services is affected by CVE-2026-40998, where Jaxp13XPathTemplate evaluates XPath on StreamSource and SAXSource inputs using the JDK's default DocumentBuilderFactory rather than Spring's hardened parser, exposing applications to XML External Entity (XXE) attacks, and CVE-2026-40994, where Wss4jSecurityInterceptor disables WSS4J WS-I Basic Security Profile enforcement during inbound validation, allowing non-compliant messages to be accepted; affected versions are 5.0.0–5.0.1, 4.1.0–4.1.3, 4.0.0–4.0.18 and 3.1.0–3.1.8. These follow the earlier CVE-2019-3773 advisory, in which Spring Web Services 2.4.3, 3.0.4 and older unsupported versions were susceptible to XXE when processing XML from untrusted sources.
Read the original coverage at National Vulnerability Database (NVD)
Captured 23 minutes ago