CVE-2026-40999 Details
Description
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
A server-side request forgery (SSRF) vulnerability has been identified in Spring Web Services. This issue arises when WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses. In such cases, Spring WS may unintentionally initiate outbound connections through WebServiceMessageSender instances to destinations specified in the request headers. The vulnerability exists without verifying the safety of these destinations. A remote attacker could exploit this by crafting addressing headers that prompt the server to connect to internal hosts, cloud metadata endpoints, or other sensitive locations.
Users of affected Spring Web Services versions should upgrade to 5.0.2, 4.1.4, 4.0.19, or 3.1.9, depending on their current version. If an upgrade is not possible, destinations can be restricted by overriding the 'supports' method of the configured WebServiceMessageSender.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://spring.io/security/cve-2026-40999 | [email protected] | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| broadcom spring web services | < 3.1.9 >= 4.0.0, < 4.0.19 >= 4.1.0, < 4.1.3.1 >= 5.0.0, < 5.0.1.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 23, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |