What is the CVSS score of CVE-2026-40998?

CVE-2026-40998 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Web Services are affected by CVE-2026-40998?

Spring Web Services versions 3.1.x through 5.0.x contain an XML processing vulnerability that exposes organizations to unauthenticated remote attacks through untrusted XML input.. A patch is available.

How to fix or mitigate CVE-2026-40998?

Within 24 hours: Inventory all applications using Spring Web Services 3.1.x, 4.0.x, 4.1.x, or 5.0.x and identify XML processing workflows. Within 7 days: Deploy Web Application Firewall rules blocking DOCTYPE declarations and external entity references; configure application XML parsers to disable external entity processing. Within 30 days: Develop upgrade strategy for patched Spring Web Services version (when available); implement enterprise-wide XML input validation controls.

Spring Web Services CVE-2026-40998

EUVD-2026-36208 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-06-11 vmware

GHSA-2mpf-m756-hxjm

Java XXE Spring Web Services

8.2

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable XML endpoint, no auth or UI, standard XXE technique gives high confidentiality (file/SSRF read) and limited integrity via response manipulation; no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:00 vuln.today

DescriptionCVE.org

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Articles & Coverage 2

News 7 New Java Vulnerabilities - 7 High Severity, No Public POC Jun 12, 2026 News 7 New Java Vulnerabilities - 7 High Severity, No Public Exploits Jun 11, 2026

AnalysisAI

XML External Entity (XXE) exposure in Spring Web Services' Jaxp13XPathTemplate allows remote attackers to abuse XPath evaluation over StreamSource and SAXSource inputs because the underlying parser falls back to the JDK's default DocumentBuilderFactory rather than Spring's hardened configuration. Affected versions span the 3.1.x, 4.0.x, 4.1.x and 5.0.x release lines, and while no public exploit was identified at time of analysis, the CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) indicates that any service that feeds untrusted XML through this template can be reached by unauthenticated remote attackers. The flaw was reported by VMware/Spring and is tracked in the official Spring security advisory.

Technical ContextAI

Spring Web Services ships Jaxp13XPathTemplate, a helper built on the JAXP 1.3 XPath API that evaluates XPath expressions against an arbitrary javax.xml.transform.Source. For StreamSource and SAXSource inputs the template internally instantiates a JDK DocumentBuilderFactory to parse the XML before applying XPath, but it failed to disable external entity resolution (FEATURE_SECURE_PROCESSING / disallow-doctype-decl / external-general-entities / external-parameter-entities), unlike the rest of Spring's hardened XML stack. This is the classic CWE-611 (Improper Restriction of XML External Entity Reference) root cause: a downstream consumer reuses a default-configured JAXP parser, so a DOCTYPE-bearing payload can dereference local files (file://), internal HTTP services, or trigger XML-bomb-style parsing. The CPE cpe:2.3:a:spring:spring_web_services covers the affected component across all impacted minor versions.

RemediationAI

Patch available per vendor advisory at https://spring.io/security/cve-2026-40998 - upgrade to the fixed release on the branch you run (5.0.x, 4.1.x, 4.0.x, or 3.1.x); the input data does not name a specific fixed version, so confirm the exact patched build against the Spring advisory before deploying. As a compensating control until upgrade, avoid passing attacker-controlled XML through Jaxp13XPathTemplate's StreamSource/SAXSource entry points (prefer DOMSource built from a pre-hardened DocumentBuilder where you have already set FEATURE_SECURE_PROCESSING, disallow-doctype-decl, and disabled external-general-entities and external-parameter-entities), or pre-validate inbound XML through a hardened parser before XPath evaluation; the trade-off is added code on every XML ingestion path and the risk of rejecting legitimate documents that include benign DTDs.