org.springframework.ws:spring-xml

2 results · Feed

• High 8.2
  CVE-2026-40998

  Jaxp13 XPath XXE via StreamSource and SAXSource

  Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications …

  Spring Spring Web Services org.springframework.ws:spring-xml Maven
  Jun 11, 2026
• Critical 9.8
  CVE-2019-3773

  Spring Web Services XML External Entity Injection (XXE)

  Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  Spring Spring Web Services org.springframework.ws:spring-xml org.springframework.ws:spring-ws Maven
  Jan 18, 2019