What is the CVSS score of CVE-2026-40991?

CVE-2026-40991 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40991?

Yes, a patch is available for CVE-2026-40991. Update the affected software to the latest version immediately.

Spring REST Docs CVE-2026-40991

EUVD-2026-35885 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-06-10 security@vmware.com

GHSA-6rpq-6vv2-5222

XXE Java Spring Rest Docs

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.springframework.restdocs:spring-restdocs-webtestclient (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.

Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.

AnalysisAI

XXE injection in Spring REST Docs exposes developer machines and CI runners to file disclosure when documentation-generating tests process responses from a remote API. Versions 4.0.0, 3.0.0-3.0.5, and 2.0.0.RELEASE-2.0.8.RELEASE of the spring-restdocs-webtestclient and spring-restdocs-restassured modules fail to disable XML external entity processing, allowing an attacker who controls the documented API endpoint to serve a malicious XML response. No confirmed active exploitation exists (not in CISA KEV), and no public exploit has been identified at time of analysis; however, the High confidentiality impact against developer and CI environments warrants prompt patching.

Technical ContextAI

Spring REST Docs is a Java framework (tagged Java, XXE) that auto-generates API documentation from integration test snippets. The vulnerable surface is limited to the spring-restdocs-webtestclient module (targeting Spring WebFlux's WebTestClient) and the spring-restdocs-restassured module (targeting REST Assured), both of which process real HTTP responses from a remote endpoint during test execution. The spring-restdocs-mockmvc module, which uses local mocks, is not in scope. CWE-611 (Improper Restriction of XML External Entity Reference) identifies the root cause: the library's XML response parser does not disable DOCTYPE declarations or external entity resolution. When an attacker-controlled API returns XML with an XXE payload such as an entity referencing a local file path or an out-of-band SSRF destination, the Java XML parser resolves it during documentation snippet generation, leaking data without the developer's awareness. Reported by security@vmware.com, indicating origin from the Spring/VMware security team.

RemediationAI

Upgrade to a patched version of Spring REST Docs per the vendor advisory at https://spring.io/security/cve-2026-40991. The exact fixed release version is not confirmed in the available intelligence data - the advisory must be consulted for the precise target version for each affected branch (4.x, 3.0.x, 2.0.x). Patch is available per vendor advisory. Where immediate upgrade is not feasible, the most targeted compensating control is to restrict documentation test execution to local mock servers only (e.g., spring-restdocs-mockmvc) and avoid running spring-restdocs-webtestclient or spring-restdocs-restassured tests against any external or third-party HTTP endpoint until patched; this eliminates the attack surface entirely but may require refactoring test suites. Additionally, CI runners should operate with least-privilege file system access and minimal secrets in the environment to limit exposure if an XXE payload is triggered, though this mitigates impact rather than preventing exploitation.