CVE-2026-40999

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://spring.io/security/cve-2026-40999	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:broadcom:spring_web_services::::::::
	cpe:2.3:a:broadcom:spring_web_services::::::::
	cpe:2.3:a:broadcom:spring_web_services::::::::
	cpe:2.3:a:broadcom:spring_web_services::::::::

History

No history.

Information

Published : 2026-06-11 07:16

Updated : 2026-09-04 18:18

NVD link : CVE-2026-40999

Mitre link : CVE-2026-40999

CVE.ORG link : CVE-2026-40999

JSON object : View

Products Affected

broadcom

spring_web_services

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-40999", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40999", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T15:06:46.401478Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Web Services", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.1.1", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.3.1", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.19", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-11T07:16:27.907", "references": [{"url": "https://spring.io/security/cve-2026-40999", "tags": ["Vendor Advisory", "Mitigation"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8."}, {"lang": "es", "value": "Cuando se utiliza WS-Addressing con direcciones ReplyTo o FaultTo no an\u00f3nimas, Spring WS puede iniciar conexiones salientes a trav\u00e9s de instancias configuradas de WebServiceMessageSender a destinos tomados directamente de los encabezados de la solicitud sin verificar que esos destinos sean seguros para conectarse.\n\nVersiones afectadas:\nSpring Web Services 5.0.0 hasta 5.0.1; 4.1.0 hasta 4.1.3; 4.0.0 hasta 4.0.18; 3.1.0 hasta 3.1.8."}], "lastModified": "2026-09-04T18:18:26.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B633BE6-BF68-4983-9CCC-DB3D353B5E5B", "versionEndExcluding": "3.1.9"}, {"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78560577-BEE7-4F51-AED1-07BABD369CE9", "versionEndExcluding": "4.0.19", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7AB4F88-7609-466A-A799-FD19E8D07284", "versionEndExcluding": "4.1.3.1", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E33A13E-4CED-4B68-8E37-8ACE603F3DAC", "versionEndExcluding": "5.0.1.1", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}