CVE-2026-40996 Details
Description
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
A vulnerability exists in Spring Web Services versions 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, and 3.1.0 through 3.1.8. The issue arises because the Wss4jSecurityInterceptor component defaulted the allowRSA15KeyTransportAlgorithm setting to true. This change overrides Apache WSS4J's safer default for validating RequestData, allowing inbound WS-Security decryption to accept RSA PKCS#1 v1.5 encrypted key material. As a result, the vulnerability increases exposure to attacks targeting this legacy key transport method, particularly in man-in-the-middle or oracle-capable positions.
Users of affected versions should upgrade to Spring Web Services 5.0.2, 4.1.4, 4.0.19, or 3.1.9. If an upgrade is not possible, the RSA PKCS#1 v1.5 encryption can be disabled by using the setAllowRSA15KeyTransportAlgorithm method and setting it to false.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://spring.io/security/cve-2026-40996 | [email protected] | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| broadcom spring web services | < 3.1.9 >= 4.0.0, < 4.0.19 >= 4.1.0, < 4.1.3.1 >= 5.0.0, < 5.0.1.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 23, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |