Vulnerability · Published Jun 11, 2026 · Assigned by vmware
CVE-2026-41000WSS4J validation does not use configured replay cache
Low 3.7
In plain English
A low-severity security flaw in Spring Web Services from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.ws:spring-ws-security | 5.0.2 | GHSA-8qq9-r6cc-qjv9 |
| Maven | org.springframework.ws:spring-ws-security | 4.1.4 | GHSA-8qq9-r6cc-qjv9 |
| Maven | org.springframework.ws:spring-ws-security | no fix listed | GHSA-8qq9-r6cc-qjv9 |
| Maven | org.springframework.ws:spring-ws-security | no fix listed | GHSA-8qq9-r6cc-qjv9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Web Services | 5.0.0 – before 5.0.1.14.1.0 – before 4.1.3.14.0.0 – before 4.0.193.1.0 – before 3.1.9 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N