What is the CVSS score of CVE-2026-40999?

CVE-2026-40999 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Web Services are affected by CVE-2026-40999?

Spring Web Services versions 3.1.0 through 5.0.1 contain an unauthenticated Server-Side Request Forgery vulnerability (CVSS 8.6) that allows attackers to redirect the server into initiating…. A patch is available.

How to fix or mitigate CVE-2026-40999?

Within 24 hours: Identify all systems running Spring Web Services and confirm which versions (3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, 5.0.0-5.0.1) are deployed in production and development environments. Within 7 days: Deploy network egress filtering rules to restrict outbound HTTP(S) traffic from affected systems to only required destinations; implement Web Application Firewall (WAF) rules to block requests with suspicious WS-Addressing ReplyTo/FaultTo header values; disable SOAP endpoints not in active use. Within 30 days: Establish monitoring for vendor patch release; develop and test upgrade path to patched versions when available; document all compensating controls in incident response procedures.

Spring Web Services CVE-2026-40999

EUVD-2026-36209 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-11 vmware

GHSA-whpp-xv3h-rwxf

Java SSRF Spring Web Services

8.6

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network-reachable SOAP endpoint (AV:N/AC:L/PR:N/UI:N); SSRF reaches resources outside the vulnerable component (S:C); primary impact is reading internal data (C:H), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:00 vuln.today

DescriptionCVE.org

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Articles & Coverage 2

News 7 New Java Vulnerabilities - 7 High Severity, No Public POC Jun 12, 2026 News 7 New Java Vulnerabilities - 7 High Severity, No Public Exploits Jun 11, 2026

AnalysisAI

Server-Side Request Forgery in Spring Web Services (versions 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1) allows remote unauthenticated attackers to coerce the server into initiating outbound HTTP connections to attacker-controlled or internal destinations by abusing WS-Addressing ReplyTo/FaultTo headers. The flaw stems from WebServiceMessageSender instances dispatching to destinations taken directly from SOAP request headers without validating that the targets are safe. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Spring Web Services is the SOAP/contract-first web services framework in the Spring portfolio, widely used to expose enterprise SOAP endpoints on the JVM. The vulnerability lives in the WS-Addressing implementation: when a SOAP message specifies a non-anonymous wsa:ReplyTo or wsa:FaultTo address, the framework hands that URI to a configured WebServiceMessageSender (HTTP, JMS, etc.) to deliver the asynchronous response or fault. Because the destination URI comes directly from untrusted request headers and is not vetted against an allowlist or filtered for internal/loopback/metadata targets, the server itself performs the outbound request. This is the classic CWE-918 Server-Side Request Forgery pattern, here exposed via a standards-compliant SOAP feature rather than a custom URL-fetch endpoint.

RemediationAI

Upgrade to a fixed maintenance release in each supported line as published in the Spring advisory at https://spring.io/security/cve-2026-40999 (patch available per vendor advisory; exact fixed versions should be taken from that page since the input does not enumerate them). Where immediate upgrade is not possible, disable or remove the WS-Addressing interceptor from the message dispatcher configuration if the application does not require asynchronous reply/fault routing - this eliminates the dangerous header processing but breaks any client that relies on non-anonymous ReplyTo/FaultTo. Alternatively, wrap or replace the configured WebServiceMessageSender with one that enforces an allowlist of permitted reply destinations and rejects loopback, link-local (including 169.254.169.254), RFC1918, and internal hostnames; this preserves WS-Addressing functionality at the cost of additional configuration and maintenance. Finally, restrict egress at the network layer from the Spring WS host so that only required downstream endpoints are reachable, which limits SSRF blast radius but does not by itself stop in-VPC pivots.