Product · Spring

Spring REST Docs

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 5.9

CVE-2026-40991

XML External Entity (XXE) injection when documenting untrusted XML content

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documenta…

Spring Spring REST Docs org.springframework.restdocs:spring-restdocs-restassured org.springframework.restdocs:spring-restdocs-webtestclient Maven

Jun 9, 2026