Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-40991XML External Entity (XXE) injection when documenting untrusted XML content
Medium 5.9
In plain English
A medium-severity XML external entity in Spring REST Docs from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.restdocs:spring-restdocs-restassured | 4.0.1 | GHSA-6rpq-6vv2-5222 |
| Maven | org.springframework.restdocs:spring-restdocs-restassured | 3.0.6 | GHSA-6rpq-6vv2-5222 |
| Maven | org.springframework.restdocs:spring-restdocs-restassured | no fix listed | GHSA-6rpq-6vv2-5222 |
| Maven | org.springframework.restdocs:spring-restdocs-webtestclient | 4.0.1 | GHSA-6rpq-6vv2-5222 |
| Maven | org.springframework.restdocs:spring-restdocs-webtestclient | 3.0.6 | GHSA-6rpq-6vv2-5222 |
| Maven | org.springframework.restdocs:spring-restdocs-webtestclient | no fix listed | GHSA-6rpq-6vv2-5222 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring REST Docs | 4.0.0 – before 4.0.0.13.0.0 – before 3.0.5.12.0.0.RELEASE – before 2.0.9.RELEASE |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L