Spring Spring Web Services

• CVE-2026-41000 Low 3.7 WSS4J validation does not use configured replay cache 0.2%
• CVE-2026-40999 High 8.6 Spring WS SSRF via unvalidated WS-Addressing reply destinations 0.4%
• CVE-2026-40998 High 8.2 Jaxp13 XPath XXE via StreamSource and SAXSource 0.4%
• CVE-2026-40997 Medium 5.3 SOAP security faults leak Spring Security account state 0.4%
• CVE-2026-40996 Medium 4.8 Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default 0.1%
• CVE-2026-40995 Medium 5.4 X.509 authentication bypasses Spring Security account checks 0.1%
• CVE-2026-40994 High 8.2 Wss4jSecurityInterceptor disables WS-I BSP validation by default 0.2%