Spring Spring Web Services vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20267

Newest CVEs

• CVE-2026-41000

  WSS4J validation does not use configured replay cache

  Spring · Spring Web Services

  Low3.7
• CVE-2026-40999

  Spring WS SSRF via unvalidated WS-Addressing reply destinations

  Spring · Spring Web Services

  High8.6
• CVE-2026-40998

  Jaxp13 XPath XXE via StreamSource and SAXSource

  Spring · Spring Web Services

  High8.2
• CVE-2026-40997

  SOAP security faults leak Spring Security account state

  Spring · Spring Web Services

  Medium5.3
• CVE-2026-40996

  Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

  Spring · Spring Web Services

  Medium4.8
• CVE-2026-40995

  X.509 authentication bypasses Spring Security account checks

  Spring · Spring Web Services

  Medium5.4
• CVE-2026-40994

  Wss4jSecurityInterceptor disables WS-I BSP validation by default

  Spring · Spring Web Services

  High8.2
• CVE-2019-3773

  Spring Web Services XML External Entity Injection (XXE)

  Spring · Spring Web Services

  Critical9.8