XML External Entity injection in Spring Web Services - CVE-2026-40998
Published: August 28, 2026
Vulnerability identifier: #VU146188
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40998
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information or perform server-side request forgery.
The vulnerability exists due to improper restriction of XML external entity references in Jaxp13XPathTemplate when evaluating XPath expressions on StreamSource or SAXSource inputs. A remote attacker can supply crafted XML with external entities to disclose sensitive information or perform server-side request forgery.
Exploitation requires that the application evaluate XPath expressions against untrusted XML data and use the affected source types without an additional hardening layer.
Affected software
Spring Web Services
How to mitigate CVE-2026-40998
Install security update from vendor's website.
Spring Web Services - addressed in versions 3.1.9, 4.0.19, 4.1.3.1, 4.1.4, 5.0.1.1, 5.0.2