SB20260828159 - Multiple vulnerabilities in Spring Web Services
Published: August 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-40994)
CWE-ID: CWE-1188 - Insecure Default Initialization of Resource
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass protocol-level security checks.
The vulnerability exists due to improper security configuration in Wss4jSecurityInterceptor when validating inbound WS-Security messages. A remote attacker can send a specially crafted message that violates BSP rules around signatures and related constructs to bypass protocol-level security checks.
Exploitation requires use of Wss4jSecurityInterceptor for inbound validation without explicitly enabling BSP compliance.
2) Improper Authentication (CVE-ID: CVE-2026-40995)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass account lifecycle checks and authenticate with a disabled, locked, expired, or credentials-expired account.
The vulnerability exists due to improper authentication in X509AuthenticationProvider when processing certificate-based authentication. A remote user can present a certificate that maps to UserDetails to bypass account lifecycle checks and authenticate with a disabled, locked, expired, or credentials-expired account.
The issue affects users resolved from X509AuthoritiesPopulator and cached entries, and requires Spring WS X.509 integration with Spring Security.
3) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-40996)
CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or modify data.
The vulnerability exists due to the use of a legacy cryptographic algorithm in Wss4jSecurityInterceptor when processing inbound WS-Security decryption with RSA PKCS#1 v1.5 key transport. A remote attacker can leverage acceptance of rsa-1_5 encrypted key material to disclose sensitive information or modify data.
Exploitation requires inbound XML encryption or key transport handled through WSS4J and peers that negotiate or emit RSA v1.5 key transport, and is relevant in man-in-the-middle or oracle-capable positions.
4) XML External Entity injection (CVE-ID: CVE-2026-40998)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or perform server-side request forgery.
The vulnerability exists due to improper restriction of XML external entity references in Jaxp13XPathTemplate when evaluating XPath expressions on StreamSource or SAXSource inputs. A remote attacker can supply crafted XML with external entities to disclose sensitive information or perform server-side request forgery.
Exploitation requires that the application evaluate XPath expressions against untrusted XML data and use the affected source types without an additional hardening layer.
5) Protection mechanism failure (CVE-ID: CVE-2026-41000)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass replay protections.
The vulnerability exists due to improper security control enforcement in Wss4jSecurityInterceptor validation handling when validating SOAP security constructs that rely on replay detection. A remote attacker can re-submit still-valid cryptographic material to bypass replay protections.
Exploitation requires validation of UsernameToken nonces or creation timestamps, Timestamp elements, or certain SAML one-time-use semantics, and the service must accept repeated SOAP messages within the acceptance window.
6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-40999)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper input validation in AbstractAddressingEndpointMapping handling of WS-Addressing reply destinations when processing non-anonymous ReplyTo or FaultTo addresses from request headers. A remote attacker can supply crafted WS-Addressing headers to perform server-side request forgery.
Only deployments with one or more configured WebServiceMessageSender instances for out-of-band replies that accept WS-Addressing headers from untrusted callers are vulnerable.
7) Information Exposure Through an Error Message (CVE-ID: CVE-2026-40997)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper handling of authentication error messages in Spring WS integration paths with Spring Security when processing SOAP authentication requests. A remote attacker can send crafted authentication attempts to disclose sensitive information.
This can expose whether an account is valid and reveal account state details such as locked or disabled status through exception messages or callback outcomes. It affects username-token, digest, or X.509 validation paths where account status exceptions reach the SOAP layer without uniform BadCredentialsException handling.
Remediation
Install update from vendor's website.