Jaxp13 XPath XXE via StreamSource and SAXSource (Spring Spring Web Services)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.35 % · percentile 29 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Analyzed
Description
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Weaknesses (CWE)
- CWE-611 — Improper Restriction of XML External Entity Reference
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | vmware |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · security@vmware.com (Secondary) |
Advisories
- GHSA-2mpf-m756-hxjm — Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
European references
- ENISA EUVD · EUVD-2026-36208
- GCVE · GCVE-0-2026-40998
CERT-FR advisories
- CERTFR-2026-AVI-0739 — Multiples vulnérabilités dans les produits Spring · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*< 3.1.9cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.19cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.3.1cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.1.1
Affected products
| Product | Versions |
|---|---|
| Spring · Spring Web Services | affected 5.0.0 < 5.0.1.1 ; affected 4.1.0 < 4.1.3.1 ; affected 4.0.0 < 4.0.19 ; affected 3.1.0 < 3.1.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |