Vulnerability · Published Jun 11, 2026 · Assigned by vmware
CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinations
High 8.6
In plain English
A high-severity server-side request forgery in Spring Web Services from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.ws:spring-ws-core | 5.0.2 | GHSA-whpp-xv3h-rwxf |
| Maven | org.springframework.ws:spring-ws-core | 4.1.4 | GHSA-whpp-xv3h-rwxf |
| Maven | org.springframework.ws:spring-ws-core | no fix listed | GHSA-whpp-xv3h-rwxf |
| Maven | org.springframework.ws:spring-ws-core | no fix listed | GHSA-whpp-xv3h-rwxf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Web Services | 5.0.0 – before 5.0.1.14.1.0 – before 4.1.3.14.0.0 – before 4.0.193.1.0 – before 3.1.9 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N