CVE-2026-40999highCWE-918

CVE-2026-40999: falha de alta gravidade em Spring Web Services

Spring WS SSRF via unvalidated WS-Addressing reply destinations

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Web Services+ Monitorar org.springframework.ws:spring-ws-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
Spring · Spring Web Services
CVEs relacionadas — Spring Web Services

No mesmo produto, das mais perigosas para as menos.

CVE-2019-3773—Spring Web Services XML External Entity Injection (XXE)EPSS 4.1%CVE-2026-40997MEDIUMSOAP security faults leak Spring Security account stateEPSS 0.4%CVE-2026-40998HIGHJaxp13 XPath XXE via StreamSource and SAXSourceEPSS 0.4%CVE-2026-40994HIGHWss4jSecurityInterceptor disables WS-I BSP validation by defaultEPSS 0.2%CVE-2026-41000LOWWSS4J validation does not use configured replay cacheEPSS 0.2%CVE-2026-40995MEDIUMX.509 authentication bypasses Spring Security account checksEPSS 0.1%