CVE-2026-40998
Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40998- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2026-36208
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
EUVD-2026-36208- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2mpf-m756-hxjm
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-2mpf-m756-hxjm- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40998- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40998- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-2mpf-m756-hxjm
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-2mpf-m756-hxjm- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Show 16 moreShow less
OSVCLSA-2026-1788350691 No score
TuxCare security update for org.springframework.ws:spring-xml (1 CVE)
TuxCare rebuilt org.springframework.ws:spring-xml to address 1 CVE. Fixed in 4.0.15-tuxcare.1.
- Record
CLSA-2026-1788350691- Updated
- 2026-11-02
OSVCLSA-2026-1788508031 No score
TuxCare security update for org.springframework.ws (2 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.17-tuxcare.5.
- Record
CLSA-2026-1788508031- Updated
- 2026-11-02
OSVCLSA-2026-1789663751 No score
TuxCare security update for org.springframework.ws (2 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.14-tuxcare.1.
- Record
CLSA-2026-1789663751- Updated
- 2026-11-02
OSVCLSA-2026-1791841427 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.
- Record
CLSA-2026-1791841427- Updated
- 2026-11-02
OSVCLSA-2026-1791842265 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.
- Record
CLSA-2026-1791842265- Updated
- 2026-11-02
OSVCLSA-2026-1791878893 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791878893- Updated
- 2026-11-02
OSVCLSA-2026-1791879447 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.
- Record
CLSA-2026-1791879447- Updated
- 2026-11-02
OSVCLSA-2026-1791895043 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.
- Record
CLSA-2026-1791895043- Updated
- 2026-11-02
OSVCLSA-2026-1791896844 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.
- Record
CLSA-2026-1791896844- Updated
- 2026-11-02
OSVCLSA-2026-1791897718 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.
- Record
CLSA-2026-1791897718- Updated
- 2026-11-02
OSVCLSA-2026-1791898135 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791898135- Updated
- 2026-11-02
OSVCLSA-2026-1791901615 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791901615- Updated
- 2026-11-02
OSVCLSA-2026-1793839298 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.4-tuxcare.3.
- Record
CLSA-2026-1793839298- Updated
- 2026-11-05
OSVCLSA-2026-1793859202 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.5-tuxcare.3.
- Record
CLSA-2026-1793859202- Updated
- 2026-11-05
OSVCLSA-2026-1793889628 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 4.0.16-tuxcare.2.
- Record
CLSA-2026-1793889628- Updated
- 2026-11-06
OSVROOT-APP-MAVEN-CVE-2026-40998 No score
CVE-2026-40998 in org.springframework.ws:spring-xml - Patched by Root
Root has patched CVE-2026-40998 in the org.springframework.ws:spring-xml package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40998- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-xmlMaven |
5.0.0 to 5.0.1 | 5.0.2 |
org.springframework.ws:spring-xmlMaven |
4.1.0 to 4.1.3 | 4.1.4 |
org.springframework.ws:spring-xmlMaven |
4.0.0 to 4.0.18 | None known |
org.springframework.ws:spring-xmlMaven |
3.1.0 to 3.1.8 | None known |
org.springframework.ws:spring-xmlTuxCare:Maven |
4.0.15 up to 4.0.15-tuxcare.1 | 4.0.15-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.0.17 up to 4.0.17-tuxcare.5, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.4 |
4.0.17-tuxcare.5 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 2 CVEs |
4.0.17 up to 4.0.17-tuxcare.5, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.4 |
4.0.17-tuxcare.5 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.0.14 up to 4.0.14-tuxcare.1 | 4.0.14-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 2 CVEs |
4.0.14 up to 4.0.14-tuxcare.1 | 4.0.14-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-xmlMaven |
5.0.0 up to 5.0.2, plus listed versions 5.0.1 |
5.0.2 |
org.springframework.ws:spring-xmlMaven |
4.1.0 up to 4.1.4, plus listed versions 4.1.14.1.24.1.3 |
4.1.4 |
org.springframework.ws:spring-xmlMaven |
4.0.0 to 4.0.18, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 12 moreShow less4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 |
None known |
org.springframework.ws:spring-xmlMaven |
3.1.0 to 3.1.8, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.63.1.7 |
None known |
org.springframework.ws:spring-xmlRoot:Maven |
before 5.0.1-aikido.2 | 5.0.1-aikido.24.1.3-aikido.2 |
io.root.org.springframework.ws:spring-xmlRoot:Maven |
before 5.0.1-root.io.2 | 5.0.1-root.io.24.1.3-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40998 is a high vulnerability (CVSS 8.2) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in org.springframework.ws:spring-xml 5.0.2.
References
spring.io/security/cve-2026-40998
nvd.nist.gov/vuln/detail/CVE-2026-40998
github.com/spring-projects/spring-ws/commit/eb8d66c0995d1e1dd5bfcfb657c8c9de21266d97