CVE-2026-40994
Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40994- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2026-36204
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
EUVD-2026-36204- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gg9r-wr4p-w63h
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-gg9r-wr4p-w63h- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
NVD
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40994- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
OSV
Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40994- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-08
OSVGHSA-gg9r-wr4p-w63h
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-gg9r-wr4p-w63h- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
Show 17 moreShow less
OSVUBUNTU-CVE-2026-40994
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
UBUNTU-CVE-2026-40994- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1791320385No score
TuxCare security update for org.springframework.ws (6 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.
- Record
CLSA-2026-1791320385- Updated
- 2026-11-02
OSVCLSA-2026-1791815784No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.17-tuxcare.6.
- Record
CLSA-2026-1791815784- Updated
- 2026-11-02
OSVCLSA-2026-1791841427No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.
- Record
CLSA-2026-1791841427- Updated
- 2026-11-02
OSVCLSA-2026-1791842265No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.
- Record
CLSA-2026-1791842265- Updated
- 2026-11-02
OSVCLSA-2026-1791878893No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791878893- Updated
- 2026-11-02
OSVCLSA-2026-1791879222No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.14-tuxcare.2.
- Record
CLSA-2026-1791879222- Updated
- 2026-11-02
OSVCLSA-2026-1791879447No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.
- Record
CLSA-2026-1791879447- Updated
- 2026-11-02
OSVCLSA-2026-1791895043No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.
- Record
CLSA-2026-1791895043- Updated
- 2026-11-02
OSVCLSA-2026-1791896844No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.
- Record
CLSA-2026-1791896844- Updated
- 2026-11-02
OSVCLSA-2026-1791897718No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.
- Record
CLSA-2026-1791897718- Updated
- 2026-11-02
OSVCLSA-2026-1791898135No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791898135- Updated
- 2026-11-02
OSVCLSA-2026-1791901615No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791901615- Updated
- 2026-11-02
OSVCLSA-2026-1793839298No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.4-tuxcare.3.
- Record
CLSA-2026-1793839298- Updated
- 2026-11-05
OSVCLSA-2026-1793859202No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.5-tuxcare.3.
- Record
CLSA-2026-1793859202- Updated
- 2026-11-05
OSVCLSA-2026-1793889628No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 4.0.16-tuxcare.2.
- Record
CLSA-2026-1793889628- Updated
- 2026-11-06
OSVROOT-APP-MAVEN-CVE-2026-40994No score
CVE-2026-40994 in org.springframework.ws:spring-ws-security - Patched by Root
Root has patched CVE-2026-40994 in the org.springframework.ws:spring-ws-security package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40994- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-securityMaven | 5.0.0 to 5.0.1 | 5.0.2 |
org.springframework.ws:spring-ws-securityMaven | 4.1.0 to 4.1.3 | 4.1.4 |
org.springframework.ws:spring-ws-securityMaven | 4.0.0 to 4.0.18 | None known |
org.springframework.ws:spring-ws-securityMaven | 3.1.0 to 3.1.8 | None known |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 6 CVEs | 4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 | 4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 6 CVEs | 4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 | 4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs | 4.0.17 up to 4.0.17-tuxcare.6, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.44.0.17-tuxcare.5 | 4.0.17-tuxcare.6 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
Show 43 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 | 3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 | 3.1.8-tuxcare.4 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 | 3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs | 4.0.14 up to 4.0.14-tuxcare.2, plus listed versions 4.0.14-tuxcare.1 | 4.0.14-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 | 3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 | 3.1.6-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 | 3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 | 3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 | 3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 | 3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs | 2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 | 2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs | 2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 | 2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs | 2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 | 2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 | 3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs | 3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 | 3.1.4-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs | 3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 | 3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 | 3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs | 3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 | 3.1.5-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs | 3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 | 3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs | 4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 | 4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs | 4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 | 4.0.16-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs | 4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 | 4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityMaven | 5.0.0 up to 5.0.2, plus listed versions 5.0.1 | 5.0.2 |
org.springframework.ws:spring-ws-securityMaven | 4.1.0 up to 4.1.4, plus listed versions 4.1.14.1.24.1.3 | 4.1.4 |
org.springframework.ws:spring-ws-securityMaven | 4.0.0 to 4.0.18, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 12 moreShow less4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 | None known |
org.springframework.ws:spring-ws-securityMaven | 3.1.0 to 3.1.8, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.63.1.7 | None known |
org.springframework.ws:spring-ws-securityRoot:Maven | before 5.0.1-aikido.2 | 5.0.1-aikido.24.1.3-aikido.2 |
io.root.org.springframework.ws:spring-ws-securityRoot:Maven | before 5.0.1-root.io.2 | 5.0.1-root.io.24.1.3-root.io.2 |
itsUbuntu:16.04:LTS | All versions, plus listed versions 1.1.8-5 | None known |
itsUbuntu:18.04:LTS | All versions, plus listed versions 1.1.8-6build11.1.8-6.1 | None known |
itsUbuntu:20.04:LTS | All versions, plus listed versions 1.1.8-7 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40994 is a high vulnerability (CVSS 8.2) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in org.springframework.ws:spring-ws-security 5.0.2.