CVE-2026-40997
SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40997- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2026-36207
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
EUVD-2026-36207- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5x25-c2rf-f2jx
Spring Web Services: SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-5x25-c2rf-f2jx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40997- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40997- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-5x25-c2rf-f2jx
Spring Web Services: SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-5x25-c2rf-f2jx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2026-40997
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
UBUNTU-CVE-2026-40997- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1791320385 No score
TuxCare security update for org.springframework.ws (6 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.
- Record
CLSA-2026-1791320385- Updated
- 2026-11-02
OSVCLSA-2026-1791815784 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.17-tuxcare.6.
- Record
CLSA-2026-1791815784- Updated
- 2026-11-02
OSVCLSA-2026-1791841427 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.
- Record
CLSA-2026-1791841427- Updated
- 2026-11-02
OSVCLSA-2026-1791842265 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.
- Record
CLSA-2026-1791842265- Updated
- 2026-11-02
OSVCLSA-2026-1791878893 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791878893- Updated
- 2026-11-02
OSVCLSA-2026-1791879222 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.14-tuxcare.2.
- Record
CLSA-2026-1791879222- Updated
- 2026-11-02
OSVCLSA-2026-1791879447 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.
- Record
CLSA-2026-1791879447- Updated
- 2026-11-02
OSVCLSA-2026-1791895043 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.
- Record
CLSA-2026-1791895043- Updated
- 2026-11-02
OSVCLSA-2026-1791896844 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.
- Record
CLSA-2026-1791896844- Updated
- 2026-11-02
OSVCLSA-2026-1791897718 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.
- Record
CLSA-2026-1791897718- Updated
- 2026-11-02
OSVCLSA-2026-1791898135 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791898135- Updated
- 2026-11-02
OSVCLSA-2026-1791901615 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791901615- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-securityMaven |
5.0.0 to 5.0.1 | 5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 to 4.1.3 | 4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18 | None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8 | None known |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.17 up to 4.0.17-tuxcare.6, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.44.0.17-tuxcare.5 |
4.0.17-tuxcare.6 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
Show 37 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.14 up to 4.0.14-tuxcare.2, plus listed versions 4.0.14-tuxcare.1 |
4.0.14-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityMaven |
5.0.0 up to 5.0.2, plus listed versions 5.0.1 |
5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 up to 4.1.4, plus listed versions 4.1.14.1.24.1.3 |
4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 12 moreShow less4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 |
None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.63.1.7 |
None known |
springUbuntu:16.04:LTS |
All versions, plus listed versions 100.0+dfsg-2100.0+dfsg-2build1 |
None known |
springUbuntu:18.04:LTS |
All versions, plus listed versions 103.0+dfsg2-1103.0+dfsg2-1build1104.0+dfsg-2 |
None known |
springUbuntu:20.04:LTS |
All versions, plus listed versions 104.0+dfsg-3build2104.0+dfsg-4ubuntu1104.0+dfsg-4ubuntu2104.0+dfsg-4ubuntu5104.0+dfsg-4ubuntu6104.0+dfsg-4ubuntu7 |
None known |
springUbuntu:22.04:LTS |
All versions, plus listed versions 105.0.1+dfsg-2105.0.1+dfsg-3ubuntu1105.0.1+dfsg-3ubuntu2105.0.1+dfsg-4 |
None known |
springUbuntu:24.04:LTS |
All versions, plus listed versions 106.0+dfsg-2106.0+dfsg-3106.0+dfsg-3build2106.0+dfsg-3build3 |
None known |
springUbuntu:25.10 |
All versions, plus listed versions 106.0+dfsg-4 |
None known |
springUbuntu:26.10 |
All versions, plus listed versions 106.0+dfsg-4106.0+dfsg-5 |
None known |
springUbuntu:26.04:LTS |
All versions, plus listed versions 106.0+dfsg-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40997 is a medium vulnerability (CVSS 5.3) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in org.springframework.ws:spring-ws-security 5.0.2.
References
spring.io/security/cve-2026-40997
nvd.nist.gov/vuln/detail/CVE-2026-40997
github.com/spring-projects/spring-ws/commit/5051fae1a836c4d7fa12dedebdca23494764e421
ubuntu.com/security/CVE-2026-40997
cve.org/CVERecord?id=CVE-2026-40997