PatchTheCVEspring web services vulnerabilities and fixes
Recent CVEs affecting spring web services, with upgrade or downgrade steps. 7 tracked.
Also searched as: springwebservices.
spring web services has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-06-11. Highest priority: CVE-2026-40999 (score 43/100).
- CVE-2026-40998 HIGH 8.2 UPGRADE Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that p
- CVE-2026-40999 HIGH 8.6 UPGRADE When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound co
- CVE-2026-41000 LOW 3.7 UPGRADE Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for val
- CVE-2026-40994 HIGH 8.2 UPGRADE Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound val
- CVE-2026-40995 MEDIUM 5.4 UPGRADE X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certific
- CVE-2026-40996 MEDIUM 4.8 UPGRADE Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer de
- CVE-2026-40997 MEDIUM 5.3 UPGRADE Several Spring WS integration paths with Spring Security could surface detailed account state (for example loc
FAQ
How do I fix spring web services vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring web services being exploited right now?
None of the tracked spring web services CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring web services CVE should I patch first?
CVE-2026-40999 currently ranks highest (43/100): When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound co.