Every CVE Search/ Get API key

CVE-2026-40999

Spring WS SSRF via unvalidated WS-Addressing reply destinations

8.6 HighFix available

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.38%Up 0.4 points since Jun 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.6

Spring WS SSRF via unvalidated WS-Addressing reply destinations

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Record
CVE-2026-40999
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-36209 8.6

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Record
EUVD-2026-36209
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-whpp-xv3h-rwxf 8.6

Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Record
GHSA-whpp-xv3h-rwxf
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 8.6

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Record
CVE-2026-40999
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 8.6

Spring WS SSRF via unvalidated WS-Addressing reply destinations

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Record
CVE-2026-40999
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-whpp-xv3h-rwxf 8.6

Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Record
GHSA-whpp-xv3h-rwxf
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
Show 16 moreShow less
OSVCLSA-2026-1788508031 No score

TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 2 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.17-tuxcare.5.

Record
CLSA-2026-1788508031
Updated
2026-11-02
OSVCLSA-2026-1789663751 No score

TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 2 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.14-tuxcare.1.

Record
CLSA-2026-1789663751
Updated
2026-11-02
OSVCLSA-2026-1791320385 No score

TuxCare security update for org.springframework.ws (6 CVEs)

TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.

Record
CLSA-2026-1791320385
Updated
2026-11-02
OSVCLSA-2026-1791841427 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.

Record
CLSA-2026-1791841427
Updated
2026-11-02
OSVCLSA-2026-1791842265 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.

Record
CLSA-2026-1791842265
Updated
2026-11-02
OSVCLSA-2026-1791878893 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.

Record
CLSA-2026-1791878893
Updated
2026-11-02
OSVCLSA-2026-1791879447 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.

Record
CLSA-2026-1791879447
Updated
2026-11-02
OSVCLSA-2026-1791895043 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.

Record
CLSA-2026-1791895043
Updated
2026-11-02
OSVCLSA-2026-1791896844 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.

Record
CLSA-2026-1791896844
Updated
2026-11-02
OSVCLSA-2026-1791897718 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.

Record
CLSA-2026-1791897718
Updated
2026-11-02
OSVCLSA-2026-1791898135 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.

Record
CLSA-2026-1791898135
Updated
2026-11-02
OSVCLSA-2026-1791901615 No score

TuxCare security update for org.springframework.ws (7 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.

Record
CLSA-2026-1791901615
Updated
2026-11-02
OSVCLSA-2026-1793839298 No score

TuxCare security update for org.springframework.ws (5 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.4-tuxcare.3.

Record
CLSA-2026-1793839298
Updated
2026-11-05
OSVCLSA-2026-1793859202 No score

TuxCare security update for org.springframework.ws (5 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.5-tuxcare.3.

Record
CLSA-2026-1793859202
Updated
2026-11-05
OSVCLSA-2026-1793889628 No score

TuxCare security update for org.springframework.ws (5 CVEs)

TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 4.0.16-tuxcare.2.

Record
CLSA-2026-1793889628
Updated
2026-11-06
OSVROOT-APP-MAVEN-CVE-2026-40999 No score

CVE-2026-40999 in org.springframework.ws:spring-ws-core - Patched by Root

Root has patched CVE-2026-40999 in the org.springframework.ws:spring-ws-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-40999
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.springframework.ws:spring-ws-core
Maven
 5.0.0 to 5.0.1
5.0.2
org.springframework.ws:spring-ws-core
Maven
 4.1.0 to 4.1.3
4.1.4
org.springframework.ws:spring-ws-core
Maven
 4.0.0 to 4.0.18 None known
org.springframework.ws:spring-ws-core
Maven
 3.1.0 to 3.1.8 None known
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 2 CVEs
 4.0.17 up to 4.0.17-tuxcare.5, plus listed versions
4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.4
4.0.17-tuxcare.5
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 2 CVEs
 4.0.17 up to 4.0.17-tuxcare.5, plus listed versions
4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.4
4.0.17-tuxcare.5
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 2 CVEs
 4.0.14 up to 4.0.14-tuxcare.1
4.0.14-tuxcare.1
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 2 CVEs
 4.0.14 up to 4.0.14-tuxcare.1
4.0.14-tuxcare.1
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 6 CVEs
 4.0.15 up to 4.0.15-tuxcare.2, plus listed versions
4.0.15-tuxcare.1
4.0.15-tuxcare.2
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 6 CVEs
 4.0.15 up to 4.0.15-tuxcare.2, plus listed versions
4.0.15-tuxcare.1
4.0.15-tuxcare.2
Show 42 moreShow less
Affected packages
PackageAffectedFixed
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.8 up to 4.0.8-tuxcare.1
4.0.8-tuxcare.1
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.8 up to 4.0.8-tuxcare.1
4.0.8-tuxcare.1
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.8 up to 4.0.8-tuxcare.1
4.0.8-tuxcare.1
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.8 up to 3.1.8-tuxcare.4, plus listed versions
3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2
3.1.8-tuxcare.4
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.8 up to 3.1.8-tuxcare.4, plus listed versions
3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2
3.1.8-tuxcare.4
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.8 up to 3.1.8-tuxcare.4, plus listed versions
3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2
3.1.8-tuxcare.4
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1
3.0.10.RELEASE-tuxcare.1
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1
3.0.10.RELEASE-tuxcare.1
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1
3.0.10.RELEASE-tuxcare.1
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.6 up to 3.1.6-tuxcare.2, plus listed versions
3.1.6-tuxcare.1
3.1.6-tuxcare.2
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.6 up to 3.1.6-tuxcare.2, plus listed versions
3.1.6-tuxcare.1
3.1.6-tuxcare.2
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.6 up to 3.1.6-tuxcare.2, plus listed versions
3.1.6-tuxcare.1
3.1.6-tuxcare.2
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.7 up to 3.1.7-tuxcare.1
3.1.7-tuxcare.1
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.7 up to 3.1.7-tuxcare.1
3.1.7-tuxcare.1
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 3.1.7 up to 3.1.7-tuxcare.1
3.1.7-tuxcare.1
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.11 up to 4.0.11-tuxcare.1
4.0.11-tuxcare.1
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.11 up to 4.0.11-tuxcare.1
4.0.11-tuxcare.1
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.11 up to 4.0.11-tuxcare.1
4.0.11-tuxcare.1
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.10 up to 4.0.10-tuxcare.1
4.0.10-tuxcare.1
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.10 up to 4.0.10-tuxcare.1
4.0.10-tuxcare.1
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 4.0.10 up to 4.0.10-tuxcare.1
4.0.10-tuxcare.1
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions
3.0.7.RELEASE-tuxcare.1
3.0.7.RELEASE-tuxcare.2
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions
3.0.7.RELEASE-tuxcare.1
3.0.7.RELEASE-tuxcare.2
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions
3.0.7.RELEASE-tuxcare.1
3.0.7.RELEASE-tuxcare.2
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 7 CVEs
 2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions
2.4.5.RELEASE-tuxcare.1
2.4.5.RELEASE-tuxcare.2
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 7 CVEs
 2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions
2.4.5.RELEASE-tuxcare.1
2.4.5.RELEASE-tuxcare.2
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 7 CVEs
 2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions
2.4.5.RELEASE-tuxcare.1
2.4.5.RELEASE-tuxcare.2
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 5 CVEs
 3.1.4 up to 3.1.4-tuxcare.3, plus listed versions
3.1.4-tuxcare.13.1.4-tuxcare.2
3.1.4-tuxcare.3
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 5 CVEs
 3.1.4 up to 3.1.4-tuxcare.3, plus listed versions
3.1.4-tuxcare.13.1.4-tuxcare.2
3.1.4-tuxcare.3
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 5 CVEs
 3.1.4 up to 3.1.4-tuxcare.3, plus listed versions
3.1.4-tuxcare.13.1.4-tuxcare.2
3.1.4-tuxcare.3
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 5 CVEs
 3.1.5 up to 3.1.5-tuxcare.3, plus listed versions
3.1.5-tuxcare.13.1.5-tuxcare.2
3.1.5-tuxcare.3
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 5 CVEs
 3.1.5 up to 3.1.5-tuxcare.3, plus listed versions
3.1.5-tuxcare.13.1.5-tuxcare.2
3.1.5-tuxcare.3
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 5 CVEs
 3.1.5 up to 3.1.5-tuxcare.3, plus listed versions
3.1.5-tuxcare.13.1.5-tuxcare.2
3.1.5-tuxcare.3
org.springframework.ws:spring-ws-core
TuxCare:Maven
From an advisory covering 5 CVEs
 4.0.16 up to 4.0.16-tuxcare.2, plus listed versions
4.0.16-tuxcare.1
4.0.16-tuxcare.2
org.springframework.ws:spring-ws-security
TuxCare:Maven
From an advisory covering 5 CVEs
 4.0.16 up to 4.0.16-tuxcare.2, plus listed versions
4.0.16-tuxcare.1
4.0.16-tuxcare.2
org.springframework.ws:spring-xml
TuxCare:Maven
From an advisory covering 5 CVEs
 4.0.16 up to 4.0.16-tuxcare.2, plus listed versions
4.0.16-tuxcare.1
4.0.16-tuxcare.2
org.springframework.ws:spring-ws-core
Maven
 5.0.0 up to 5.0.2, plus listed versions
5.0.1
5.0.2
org.springframework.ws:spring-ws-core
Maven
 4.1.0 up to 4.1.4, plus listed versions
4.1.14.1.24.1.3
4.1.4
org.springframework.ws:spring-ws-core
Maven
 4.0.0 to 4.0.18, plus listed versions
4.0.14.0.104.0.114.0.124.0.13
Show 12 moreShow less
4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9
 None known
org.springframework.ws:spring-ws-core
Maven
 3.1.0 to 3.1.8, plus listed versions
3.1.13.1.23.1.33.1.43.1.53.1.63.1.7
 None known
org.springframework.ws:spring-ws-core
Root:Maven
 before 5.0.1-aikido.2
5.0.1-aikido.24.1.3-aikido.2
io.root.org.springframework.ws:spring-ws-core
Root:Maven
 before 5.0.1-root.io.2
5.0.1-root.io.24.1.3-root.io.2

History

History
RecordedChangedSources
affected, aliasesOSV
affected
affected, aliasesOSV
affected, aliases, factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40999 is a high vulnerability (CVSS 8.6) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.springframework.ws:spring-ws-core 5.0.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open