EUVD-2026-36204
GHSA-gg9r-wr4p-w63h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-reachable SOAP endpoint, no auth or UI needed (AV:N/AC:L/PR:N/UI:N); weakened WS-Security validation primarily corrupts message integrity (I:H) with limited confidentiality leakage and no availability effect.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Articles & Coverage 2
AnalysisAI
Insecure default initialization in Spring Web Services' Wss4jSecurityInterceptor disables WSS4J BSP (WS-I Basic Security Profile) enforcement on inbound RequestData, allowing remote attackers to submit SOAP messages that violate BSP-mandated WS-Security rules. Affected versions span 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1, with no public exploit identified at time of analysis. The CVSS 8.2 score reflects high integrity impact because protocol-level cryptographic checks expected by downstream consumers are silently weakened.
Technical ContextAI
Spring Web Services is the VMware/Spring framework for contract-first SOAP service development on the JVM, and Wss4jSecurityInterceptor is its bridge to Apache WSS4J for processing WS-Security (signatures, encryption, timestamps, tokens). WS-I Basic Security Profile (BSP) defines interoperability and hardening constraints on top of WS-Security - for example, restrictions on signed elements, timestamp handling, and token-reference forms - and WSS4J enforces these via a flag on its RequestData object. Per CWE-1188 (Initialization of a Resource with an Insecure Default), the interceptor initialized that flag in a way that left BSP enforcement off for inbound validation, so the underlying WSS4J engine accepted SOAP requests that a BSP-compliant server should have rejected. The affected CPE is cpe:2.3:a:spring:spring_web_services across the listed branches.
RemediationAI
Patch available per vendor advisory at https://spring.io/security/cve-2026-40994; upgrade to a fixed maintenance release on your branch (post-5.0.1, post-4.1.3, post-4.0.18, or post-3.1.8 as published by Spring) - consult the advisory for the exact released versions, as they are not enumerated in the input data. As a compensating control until upgrade, explicitly configure Wss4jSecurityInterceptor (or your validation callback handlers) so that BSP compliance enforcement is turned on for inbound RequestData, and pair this with server-side assertions that required SOAP headers (timestamp, signature over expected elements, token references) are present and well-formed, accepting that strict BSP enforcement may reject legitimate but non-compliant clients and require their reconfiguration. Where feasible, also restrict network exposure of the SOAP endpoints to trusted peers via mTLS or network ACLs to reduce the attacker population while patching proceeds.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today