CVE-2026-41000
WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-41000- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
EUVDEUVD-2026-36210
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
EUVD-2026-36210- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8qq9-r6cc-qjv9
Spring Web Services: WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-8qq9-r6cc-qjv9- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
NVD
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-41000- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
OSV
WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-41000- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
OSVGHSA-8qq9-r6cc-qjv9
Spring Web Services: WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-8qq9-r6cc-qjv9- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
Show 12 moreShow less
OSVCLSA-2026-1791320385 No score
TuxCare security update for org.springframework.ws (6 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.
- Record
CLSA-2026-1791320385- Updated
- 2026-11-02
OSVCLSA-2026-1791815784 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.17-tuxcare.6.
- Record
CLSA-2026-1791815784- Updated
- 2026-11-02
OSVCLSA-2026-1791841427 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.
- Record
CLSA-2026-1791841427- Updated
- 2026-11-02
OSVCLSA-2026-1791842265 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.
- Record
CLSA-2026-1791842265- Updated
- 2026-11-02
OSVCLSA-2026-1791878893 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791878893- Updated
- 2026-11-02
OSVCLSA-2026-1791879222 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.14-tuxcare.2.
- Record
CLSA-2026-1791879222- Updated
- 2026-11-02
OSVCLSA-2026-1791879447 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.
- Record
CLSA-2026-1791879447- Updated
- 2026-11-02
OSVCLSA-2026-1791895043 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.
- Record
CLSA-2026-1791895043- Updated
- 2026-11-02
OSVCLSA-2026-1791896844 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.
- Record
CLSA-2026-1791896844- Updated
- 2026-11-02
OSVCLSA-2026-1791897718 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.
- Record
CLSA-2026-1791897718- Updated
- 2026-11-02
OSVCLSA-2026-1791898135 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791898135- Updated
- 2026-11-02
OSVCLSA-2026-1791901615 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791901615- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-securityMaven |
5.0.0 to 5.0.1 | 5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 to 4.1.3 | 4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18 | None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8 | None known |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.17 up to 4.0.17-tuxcare.6, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.44.0.17-tuxcare.5 |
4.0.17-tuxcare.6 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.14 up to 4.0.14-tuxcare.2, plus listed versions 4.0.14-tuxcare.1 |
4.0.14-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityMaven |
5.0.0 up to 5.0.2, plus listed versions 5.0.1 |
5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 up to 4.1.4, plus listed versions 4.1.14.1.24.1.3 |
4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 12 moreShow less4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 |
None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.63.1.7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41000 is a low vulnerability (CVSS 3.7) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in org.springframework.ws:spring-ws-security 5.0.2.