Spring Web Services vulnerabilities

• broadcom spring web services, spring web services +1 more WSS4J validation does not use configured replay cache CVE-2026-41000 Fix available 3.7 LowJune 11, 2026
• broadcom spring web services, spring web services +1 more Spring WS SSRF via unvalidated WS-Addressing reply destinations CVE-2026-40999 Fix available 8.6 HighJune 11, 2026
• broadcom spring web services, spring web services +1 more Jaxp13 XPath XXE via StreamSource and SAXSource CVE-2026-40998 Fix available 8.2 HighJune 11, 2026
• broadcom spring web services, spring web services +1 more SOAP security faults leak Spring Security account state CVE-2026-40997 Fix available 5.3 MediumJune 11, 2026
• broadcom spring web services, spring web services +1 more Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default CVE-2026-40996 Fix available 4.8 MediumJune 11, 2026
• broadcom spring web services, spring web services +1 more X.509 authentication bypasses Spring Security account checks CVE-2026-40995 Fix available 5.4 MediumJune 11, 2026
• broadcom spring web services, spring web services +1 more Wss4jSecurityInterceptor disables WS-I BSP validation by default CVE-2026-40994 Fix available 8.2 HighJune 11, 2026
• broadcom spring web services, spring web services, oracle financial services analytical applications infrastructure +1 more +3 more Spring Web Services XML External Entity Injection (XXE) CVE-2019-3773 Fix available 9.8 CriticalJanuary 18, 2019