CVE-2026-40994
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Wss4jSecurityInterceptor initialized its BSP compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Risk Assessment
The risk is weakened protocol-level security controls, potentially allowing attackers to send messages that violate BSP rules, leading to integrity or confidentiality breaches.
Recommendation
Update Spring Web Services to version 5.0.2, 4.1.4, 4.0.19, or 3.1.9, depending on your branch, which contain the fix.
Other vulnerabilities in Spring Web Services
See all- CVE-2026-41000Low
In Spring Web Services (versions 5.0.0-5.0.1, 4.1.0-4.1.3, 4.0.0-4.0.18, 3.1.0-3.1.8) the Wss4jSecurityInterceptor did not properly wire ReplayCache instances into RequestData, making replay protections ineffective for UsernameToken nonces, timestamps, and SAML.
- CVE-2026-40999High
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying their safety.
- CVE-2026-40998High
Vulnerability in Spring Web Services (Jaxp13XPathTemplate) causes XPath expressions to be processed with the JDK's default configuration instead of Spring's hardened parser. This can lead to XXE (XML External Entity) attacks when processing untrusted XML data.
- CVE-2026-40997Medium
Spring Web Services integrated with Spring Security may expose detailed account state (e.g., locked or disabled user) to remote SOAP clients via exception messages or callback outcomes, instead of generic authentication errors. Affects versions 5.0.0-5.0.1, 4.1.0-4.1.3, 4.0.0-4.0.18, 3.1.0-3.1.8.
- CVE-2026-40996Medium
In Spring Web Services, Wss4jSecurityInterceptor defaults allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default. This allows acceptance of RSA PKCS#1 v1.5 (rsa-1_5) encrypted keys during WS-Security decryption unless explicitly reconfigured.
- CVE-2026-40995Medium
In Spring Web Services, X509AuthenticationProvider can issue a fully authenticated token when a certificate maps to UserDetails without applying standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Original NVD description (English source)
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.