CVE-2026-40997

{"id": "CVE-2026-40997", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40997", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T12:44:15.490096Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Web Services", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.1.1", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.3.1", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.19", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-11T07:16:27.663", "references": [{"url": "https://spring.io/security/cve-2026-40997", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8."}, {"lang": "es", "value": "Varios caminos de integraci\u00f3n de Spring WS con Spring Security podr\u00edan exponer el estado detallado de la cuenta (por ejemplo, sem\u00e1ntica de usuario bloqueado o deshabilitado) a clientes SOAP remotos a trav\u00e9s de mensajes de excepci\u00f3n o resultados de retrollamada, en lugar de fallar con errores gen\u00e9ricos de autenticaci\u00f3n. Ese comportamiento ayuda a los atacantes remotos a distinguir cuentas v\u00e1lidas de inv\u00e1lidas y a inferir el estado del ciclo de vida.\n\nVersiones afectadas:\nSpring Web Services 5.0.0 hasta 5.0.1; 4.1.0 hasta 4.1.3; 4.0.0 hasta 4.0.18; 3.1.0 hasta 3.1.8."}], "lastModified": "2026-09-04T17:01:57.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B633BE6-BF68-4983-9CCC-DB3D353B5E5B", "versionEndExcluding": "3.1.9"}, {"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78560577-BEE7-4F51-AED1-07BABD369CE9", "versionEndExcluding": "4.0.19", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7AB4F88-7609-466A-A799-FD19E8D07284", "versionEndExcluding": "4.1.3.1", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E33A13E-4CED-4B68-8E37-8ACE603F3DAC", "versionEndExcluding": "5.0.1.1", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}