CVE-2026-40999
High
Description
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
SeverityHigh
CVSS8.6
Exploit probability—
Product
Broadcom Spring Web Services
PublishedJun 11, 2026
First seenJun 11, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- broadcom spring_web_services3.1.9, 4.0.19, 4.1.3.1, 5.0.1.1 or later
- org.springframework.ws:spring-ws-core5.0.2, 4.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom spring_web_services | v < 3.1.9, 4.0.0 ≤ v < 4.0.19, 4.1.0 ≤ v < 4.1.3.1, 5.0.0 ≤ v < 5.0.1.1 | 3.1.9, 4.0.19, 4.1.3.1, 5.0.1.1 |
| org.springframework.ws:spring-ws-coreMaven | 5.0.0 ≤ v < 5.0.2, 4.1.0 ≤ v < 4.1.4, 4.0.0 ≤ v ≤ 4.0.18, 3.1.0 ≤ v ≤ 3.1.8 | 5.0.2, 4.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.