CVE-2026-40997mediumCWE-209

CVE-2026-40997: fallo de gravedad media en Spring Web Services

SOAP security faults leak Spring Security account state

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Spring Web Services+ Monitorear org.springframework.ws:spring-ws-security

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Spring · Spring Web Services
CVEs relacionadas — Spring Web Services

En el mismo producto, de las más peligrosas a las menos.

CVE-2019-3773—Spring Web Services XML External Entity Injection (XXE)EPSS 4.1%CVE-2026-40999HIGHSpring WS SSRF via unvalidated WS-Addressing reply destinationsEPSS 0.4%CVE-2026-40998HIGHJaxp13 XPath XXE via StreamSource and SAXSourceEPSS 0.4%CVE-2026-40994HIGHWss4jSecurityInterceptor disables WS-I BSP validation by defaultEPSS 0.2%CVE-2026-41000LOWWSS4J validation does not use configured replay cacheEPSS 0.2%CVE-2026-40995MEDIUMX.509 authentication bypasses Spring Security account checksEPSS 0.1%