Spring Web Services

3 results · Clear filters · Feed

• Medium 5.3
  CVE-2026-40997

  SOAP security faults leak Spring Security account state

  Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authenticatio…

  Spring Spring Web Services spring org.springframework.ws:spring-ws-security Ubuntu Maven
  Jun 11, 2026
• Medium 4.8
  CVE-2026-40996

  Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

  Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless opera…

  Spring Spring Web Services org.springframework.ws:spring-ws-security Maven
  Jun 11, 2026
• Medium 5.4
  CVE-2026-40995

  X.509 authentication bypasses Spring Security account checks

  X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired ac…

  Spring Spring Web Services org.springframework.ws:spring-ws-security Maven
  Jun 11, 2026