CVE-2026-40998

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-40998

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Jaxp13XPathTemplate evaluó expresiones XPath para entradas StreamSource y SAXSource utilizando una ruta de código que analizó XML controlado por el atacante con el comportamiento predeterminado de DocumentBuilderFactory del JDK en lugar de la configuración de analizador reforzada de Spring. Las aplicaciones que evalúan XPath contra cargas útiles XML no confiables podrían, por lo tanto, estar expuestas a ataques de estilo Entidad Externa XML (XXE). Versiones afectadas: Spring Web Services 5.0.0 a 5.0.1; 4.1.0 a 4.1.3; 4.0.0 a 4.0.18; 3.1.0 a 3.1.8.

11 Jun 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-11 07:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-40998

Mitre link : CVE-2026-40998

CVE.ORG link : CVE-2026-40998

JSON object : View

Products Affected

No product.

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-40998", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40998", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T14:53:30.481043Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Web Services", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.1.1", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.3.1", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.19", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.9", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-11T07:16:27.787", "references": [{"url": "https://spring.io/security/cve-2026-40998", "source": "security@vmware.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8."}, {"lang": "es", "value": "Jaxp13XPathTemplate evalu\u00f3 expresiones XPath para entradas StreamSource y SAXSource utilizando una ruta de c\u00f3digo que analiz\u00f3 XML controlado por el atacante con el comportamiento predeterminado de DocumentBuilderFactory del JDK en lugar de la configuraci\u00f3n de analizador reforzada de Spring. Las aplicaciones que eval\u00faan XPath contra cargas \u00fatiles XML no confiables podr\u00edan, por lo tanto, estar expuestas a ataques de estilo Entidad Externa XML (XXE).\n\nVersiones afectadas:\nSpring Web Services 5.0.0 a 5.0.1; 4.1.0 a 4.1.3; 4.0.0 a 4.0.18; 3.1.0 a 3.1.8."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security@vmware.com"}