High severity · published Jun 11, 2026
CVE-2026-40999
Spring WS SSRF via unvalidated WS-Addressing reply destinations
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Spring Web Services · Spring
5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40999
Vendor Advisory
https://spring.io/security/cve-2026-40999
More from Spring Web Services
9.8
CVE-2019-3773
Spring Web Services XML External Entity Injection (XXE)
8.2
CVE-2026-40998
Jaxp13 XPath XXE via StreamSource and SAXSource
8.2
CVE-2026-40994
Wss4jSecurityInterceptor disables WS-I BSP validation by default
5.4
CVE-2026-40995
X.509 authentication bypasses Spring Security account checks
5.3
CVE-2026-40997
SOAP security faults leak Spring Security account state