Spring Web Services (Broadcom) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 118 known versions, newest CVE from 2026-06-11. Vendor: Broadcom.

CVEs of Spring Web Services

• CVE-2026-41000 - CVSS 3.7 (low), 2026-06-11: Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections…
• CVE-2026-40999 - CVSS 8.6 (high), 2026-06-11: When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured…
• CVE-2026-40998 - CVSS 8.2 (high), 2026-06-11: Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's…
• CVE-2026-40997 - CVSS 5.3 (medium), 2026-06-11: Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP…
• CVE-2026-40996 - CVSS 4.8 (medium), 2026-06-11: Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound…
• CVE-2026-40995 - CVSS 5.4 (medium), 2026-06-11: X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying…
• CVE-2026-40994 - CVSS 8.2 (high), 2026-06-11: Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on…
• CVE-2019-3773 - CVSS 9.8 (critical), 2019-01-18: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when…