What’s Vulnerable › Products

Spring Web Services vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Spring Web Services version is affected

Latest Spring Web Services vulnerabilities

• CVE-2026-41000 — WSS4J validation does not use configured replay cache (CVSS 3.7)
• CVE-2026-40999 — Spring WS SSRF via unvalidated WS-Addressing reply destinations (CVSS 8.6)
• CVE-2026-40998 — Jaxp13 XPath XXE via StreamSource and SAXSource (CVSS 8.2)
• CVE-2026-40997 — SOAP security faults leak Spring Security account state (CVSS 5.3)
• CVE-2026-40996 — Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default (CVSS 4.8)
• CVE-2026-40995 — X.509 authentication bypasses Spring Security account checks (CVSS 5.4)
• CVE-2026-40994 — Wss4jSecurityInterceptor disables WS-I BSP validation by default (CVSS 8.2)
• CVE-2019-3773 — Spring Web Services XML External Entity Injection (XXE) (CVSS 9.8)