CVE-2026-40996
Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40996- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
EUVDEUVD-2026-36206
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
EUVD-2026-36206- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p7qj-2q5w-f9r7
Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-p7qj-2q5w-f9r7- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
NVD
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40996- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSV
Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40996- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVGHSA-p7qj-2q5w-f9r7
Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-p7qj-2q5w-f9r7- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
Show 15 moreShow less
OSVCLSA-2026-1791320385 No score
TuxCare security update for org.springframework.ws (6 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.
- Record
CLSA-2026-1791320385- Updated
- 2026-11-02
OSVCLSA-2026-1791815784 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.17-tuxcare.6.
- Record
CLSA-2026-1791815784- Updated
- 2026-11-02
OSVCLSA-2026-1791841427 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.
- Record
CLSA-2026-1791841427- Updated
- 2026-11-02
OSVCLSA-2026-1791842265 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.
- Record
CLSA-2026-1791842265- Updated
- 2026-11-02
OSVCLSA-2026-1791878893 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791878893- Updated
- 2026-11-02
OSVCLSA-2026-1791879222 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.14-tuxcare.2.
- Record
CLSA-2026-1791879222- Updated
- 2026-11-02
OSVCLSA-2026-1791879447 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.
- Record
CLSA-2026-1791879447- Updated
- 2026-11-02
OSVCLSA-2026-1791895043 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.
- Record
CLSA-2026-1791895043- Updated
- 2026-11-02
OSVCLSA-2026-1791896844 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.
- Record
CLSA-2026-1791896844- Updated
- 2026-11-02
OSVCLSA-2026-1791897718 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.
- Record
CLSA-2026-1791897718- Updated
- 2026-11-02
OSVCLSA-2026-1791898135 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791898135- Updated
- 2026-11-02
OSVCLSA-2026-1791901615 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791901615- Updated
- 2026-11-02
OSVCLSA-2026-1793839298 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.4-tuxcare.3.
- Record
CLSA-2026-1793839298- Updated
- 2026-11-05
OSVCLSA-2026-1793859202 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.5-tuxcare.3.
- Record
CLSA-2026-1793859202- Updated
- 2026-11-05
OSVCLSA-2026-1793889628 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 4.0.16-tuxcare.2.
- Record
CLSA-2026-1793889628- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-securityMaven |
5.0.0 to 5.0.1 | 5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 to 4.1.3 | 4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18 | None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8 | None known |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.17 up to 4.0.17-tuxcare.6, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.44.0.17-tuxcare.5 |
4.0.17-tuxcare.6 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.14 up to 4.0.14-tuxcare.2, plus listed versions 4.0.14-tuxcare.1 |
4.0.14-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityMaven |
5.0.0 up to 5.0.2, plus listed versions 5.0.1 |
5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 up to 4.1.4, plus listed versions 4.1.14.1.24.1.3 |
4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 12 moreShow less4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 |
None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.63.1.7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40996 is a medium vulnerability (CVSS 4.8) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in org.springframework.ws:spring-ws-security 5.0.2.