SW
Product
Spring Web Services
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 3Low 1
Watch
Add Spring Web Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3773 | 9.8 | Jan 18 | Spring Web Services XML External Entity Injection (XXE) Affected: 3.0 before v3.0.4.RELEASE; 2.4 before v2.4.3.RELEASE |
| CVE-2026-40999 | 8.6 | Jun 11 | Spring WS SSRF via unvalidated WS-Addressing reply destinations Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
| CVE-2026-40998 | 8.2 | Jun 11 | Jaxp13 XPath XXE via StreamSource and SAXSource Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
| CVE-2026-40994 | 8.2 | Jun 11 | Wss4jSecurityInterceptor disables WS-I BSP validation by default Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
| CVE-2026-40995 | 5.4 | Jun 11 | X.509 authentication bypasses Spring Security account checks Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
| CVE-2026-40997 | 5.3 | Jun 11 | SOAP security faults leak Spring Security account state Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
| CVE-2026-40996 | 4.8 | Jun 11 | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
| CVE-2026-41000 | 3.7 | Jun 11 | WSS4J validation does not use configured replay cache Affected: 5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 |
Showing 8