Spring Spring Web Services
8 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-41000 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | WSS4J validation does not use configured replay cache | LOW 3.7 | 0.2 % | ||
| CVE-2026-40999 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | Spring WS SSRF via unvalidated WS-Addressing reply destinations | HIGH 8.6 | 0.4 % | ||
| CVE-2026-40998 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | Jaxp13 XPath XXE via StreamSource and SAXSource | HIGH 8.2 | 0.4 % | ||
| CVE-2026-40997 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | SOAP security faults leak Spring Security account state | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-40996 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-40995 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | X.509 authentication bypasses Spring Security account checks | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-40994 | 5.0.0 – < 5.0.1.1 ; 4.1.0 – < 4.1.3.1 ; 4.0.0 – < 4.0.19 ; … | Wss4jSecurityInterceptor disables WS-I BSP validation by default | HIGH 8.2 | 0.2 % | ||
| CVE-2019-3773 | 3.0 – < v3.0.4.RELEASE ; 2.4 – < v2.4.3.RELEASE | Spring Web Services XML External Entity Injection (XXE) | CRITICAL 9.8 | 4.1 % |