{"id":"CVE-2026-40995","aliases":["CLSA-2026-1791320385","CLSA-2026-1791815784","CLSA-2026-1791841427","CLSA-2026-1791842265","CLSA-2026-1791878893","CLSA-2026-1791879222","CLSA-2026-1791879447","CLSA-2026-1791895043","CLSA-2026-1791896844","CLSA-2026-1791897718","CLSA-2026-1791898135","CLSA-2026-1791901615","CLSA-2026-1793839298","CLSA-2026-1793859202","CLSA-2026-1793889628","EUVD-2026-36205","GHSA-6mfm-98wv-32wm"],"status":"published","title":"X.509 authentication bypasses Spring Security account checks","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00148,"percentile":0.0404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-06-11T05:04:01Z","modified":"2026-11-06T13:15:21Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","fixed_in":["5.0.2","4.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.0.1"},{"fixed":"5.0.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"last_affected":"4.1.3"},{"fixed":"4.1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.18"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.15"},{"fixed":"4.0.15-tuxcare.2"}]}],"versions":["4.0.15","4.0.15-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.15"},{"fixed":"4.0.15-tuxcare.2"}]}],"versions":["4.0.15","4.0.15-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.17"},{"fixed":"4.0.17-tuxcare.6"}]}],"versions":["4.0.17","4.0.17-tuxcare.1","4.0.17-tuxcare.2","4.0.17-tuxcare.3","4.0.17-tuxcare.4","4.0.17-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.8"},{"fixed":"4.0.8-tuxcare.1"}]}],"versions":["4.0.8"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.8"},{"fixed":"4.0.8-tuxcare.1"}]}],"versions":["4.0.8"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.8"},{"fixed":"4.0.8-tuxcare.1"}]}],"versions":["4.0.8"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.4"}]}],"versions":["3.1.8","3.1.8-tuxcare.3","3.1.8.tuxcare","3.1.8.tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.4"}]}],"versions":["3.1.8","3.1.8-tuxcare.3","3.1.8.tuxcare","3.1.8.tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.4"}]}],"versions":["3.1.8","3.1.8-tuxcare.3","3.1.8.tuxcare","3.1.8.tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.10.RELEASE"},{"fixed":"3.0.10.RELEASE-tuxcare.1"}]}],"versions":["3.0.10.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.10.RELEASE"},{"fixed":"3.0.10.RELEASE-tuxcare.1"}]}],"versions":["3.0.10.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.10.RELEASE"},{"fixed":"3.0.10.RELEASE-tuxcare.1"}]}],"versions":["3.0.10.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.14"},{"fixed":"4.0.14-tuxcare.2"}]}],"versions":["4.0.14","4.0.14-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6"},{"fixed":"3.1.6-tuxcare.2"}]}],"versions":["3.1.6","3.1.6-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6"},{"fixed":"3.1.6-tuxcare.2"}]}],"versions":["3.1.6","3.1.6-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6"},{"fixed":"3.1.6-tuxcare.2"}]}],"versions":["3.1.6","3.1.6-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.7"},{"fixed":"3.1.7-tuxcare.1"}]}],"versions":["3.1.7"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.7"},{"fixed":"3.1.7-tuxcare.1"}]}],"versions":["3.1.7"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.7"},{"fixed":"3.1.7-tuxcare.1"}]}],"versions":["3.1.7"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.11"},{"fixed":"4.0.11-tuxcare.1"}]}],"versions":["4.0.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.11"},{"fixed":"4.0.11-tuxcare.1"}]}],"versions":["4.0.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.11"},{"fixed":"4.0.11-tuxcare.1"}]}],"versions":["4.0.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.10"},{"fixed":"4.0.10-tuxcare.1"}]}],"versions":["4.0.10"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.10"},{"fixed":"4.0.10-tuxcare.1"}]}],"versions":["4.0.10"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.10"},{"fixed":"4.0.10-tuxcare.1"}]}],"versions":["4.0.10"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.7.RELEASE"},{"fixed":"3.0.7.RELEASE-tuxcare.2"}]}],"versions":["3.0.7.RELEASE","3.0.7.RELEASE-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.7.RELEASE"},{"fixed":"3.0.7.RELEASE-tuxcare.2"}]}],"versions":["3.0.7.RELEASE","3.0.7.RELEASE-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.7.RELEASE"},{"fixed":"3.0.7.RELEASE-tuxcare.2"}]}],"versions":["3.0.7.RELEASE","3.0.7.RELEASE-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5.RELEASE"},{"fixed":"2.4.5.RELEASE-tuxcare.2"}]}],"versions":["2.4.5.RELEASE","2.4.5.RELEASE-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5.RELEASE"},{"fixed":"2.4.5.RELEASE-tuxcare.2"}]}],"versions":["2.4.5.RELEASE","2.4.5.RELEASE-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5.RELEASE"},{"fixed":"2.4.5.RELEASE-tuxcare.2"}]}],"versions":["2.4.5.RELEASE","2.4.5.RELEASE-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4"},{"fixed":"3.1.4-tuxcare.3"}]}],"versions":["3.1.4","3.1.4-tuxcare.1","3.1.4-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4"},{"fixed":"3.1.4-tuxcare.3"}]}],"versions":["3.1.4","3.1.4-tuxcare.1","3.1.4-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4"},{"fixed":"3.1.4-tuxcare.3"}]}],"versions":["3.1.4","3.1.4-tuxcare.1","3.1.4-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5"},{"fixed":"3.1.5-tuxcare.3"}]}],"versions":["3.1.5","3.1.5-tuxcare.1","3.1.5-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5"},{"fixed":"3.1.5-tuxcare.3"}]}],"versions":["3.1.5","3.1.5-tuxcare.1","3.1.5-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5"},{"fixed":"3.1.5-tuxcare.3"}]}],"versions":["3.1.5","3.1.5-tuxcare.1","3.1.5-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.16"},{"fixed":"4.0.16-tuxcare.2"}]}],"versions":["4.0.16","4.0.16-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.16"},{"fixed":"4.0.16-tuxcare.2"}]}],"versions":["4.0.16","4.0.16-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ws:spring-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.16"},{"fixed":"4.0.16-tuxcare.2"}]}],"versions":["4.0.16","4.0.16-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}],"versions":["5.0.0","5.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.4"}]}],"versions":["4.1.0","4.1.1","4.1.2","4.1.3"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.18"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.ws:spring-ws-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.8"}]}],"versions":["3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8"]}],"products":[{"vendor":"broadcom","product":"spring_web_services"},{"vendor":"spring","product":"spring web services"}],"references":[{"url":"https://spring.io/security/cve-2026-40995","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40995","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-ws/commit/e5dc311359e14f5b25bcb33f20d43cc3513e9d10","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6mfm-98wv-32wm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40995.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-ws","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40995","title":"X.509 authentication bypasses Spring Security account checks","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","status":"published","published":"2026-06-11T05:04:01.695Z","modified":"2026-06-23T19:48:20.837Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-36205","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","status":"published","published":"2026-06-11T05:04:01Z","modified":"2026-06-23T19:48:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:31.51905Z"}],"ghsa":[{"id":"GHSA-6mfm-98wv-32wm","title":"Spring Web Services: X.509 authentication bypasses Spring Security account checks","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","status":"published","published":"2026-06-11T09:31:56Z","modified":"2026-08-21T19:12:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:41:04.755504Z"}],"nvd":[{"id":"CVE-2026-40995","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","status":"published","published":"2026-06-11T07:16:27.43Z","modified":"2026-09-04T17:10:23.133Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-40995","title":"X.509 authentication bypasses Spring Security account checks","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","status":"published","published":"2026-06-11T05:04:01.695Z","modified":"2026-11-08T02:47:37.256726778Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-08T03:29:52.421856Z"},{"id":"GHSA-6mfm-98wv-32wm","title":"Spring Web Services: X.509 authentication bypasses Spring Security account checks","description":"X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","status":"published","published":"2026-06-11T09:31:56Z","modified":"2026-08-21T19:25:59.158078Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"CLSA-2026-1791320385","title":"TuxCare security update for org.springframework.ws (6 CVEs)","description":"TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.","status":"published","published":"2026-10-06T20:59:45Z","modified":"2026-11-02T19:46:26.233037223Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791815784","title":"TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)","description":"TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.17-tuxcare.6.","status":"published","published":"2026-10-12T14:36:24Z","modified":"2026-10-30T07:30:45.597508797Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791841427","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.","status":"published","published":"2026-10-12T21:43:47Z","modified":"2026-11-02T19:46:27.152972404Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791842265","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.","status":"published","published":"2026-10-12T21:57:45Z","modified":"2026-11-02T19:46:27.204564297Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791878893","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.","status":"published","published":"2026-10-13T08:08:13Z","modified":"2026-11-02T19:46:27.322875839Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791879222","title":"TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)","description":"TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.14-tuxcare.2.","status":"published","published":"2026-10-13T08:13:42Z","modified":"2026-10-30T07:30:48.221532727Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791879447","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.","status":"published","published":"2026-10-13T08:17:27Z","modified":"2026-11-02T19:46:27.263802301Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791895043","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.","status":"published","published":"2026-10-13T12:37:23Z","modified":"2026-11-02T19:46:27.263897238Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791896844","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.","status":"published","published":"2026-10-13T13:07:24Z","modified":"2026-11-02T19:46:27.264426119Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791897718","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.","status":"published","published":"2026-10-13T13:21:58Z","modified":"2026-11-02T19:46:27.165403572Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791898135","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.","status":"published","published":"2026-10-13T13:28:55Z","modified":"2026-11-02T19:46:27.285063556Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791901615","title":"TuxCare security update for org.springframework.ws (7 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.","status":"published","published":"2026-10-13T14:26:55Z","modified":"2026-11-02T19:46:27.268422476Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1793839298","title":"TuxCare security update for org.springframework.ws (5 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.4-tuxcare.3.","status":"published","published":"2026-11-05T01:41:39Z","modified":"2026-11-05T07:00:39.174275208Z","updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"CLSA-2026-1793859202","title":"TuxCare security update for org.springframework.ws (5 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.5-tuxcare.3.","status":"published","published":"2026-11-05T07:13:23Z","modified":"2026-11-05T13:15:03.277254036Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793889628","title":"TuxCare security update for org.springframework.ws (5 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 4.0.16-tuxcare.2.","status":"published","published":"2026-11-05T15:40:29Z","modified":"2026-11-06T13:15:21.602768162Z","updated_at":"2026-11-06T13:44:09.891978Z"}]}}