XML External Entity (XXE) injection when documenting untrusted XML content
CVE-2026-40991

5.9MEDIUM

Key Information:

Vendor

Spring

Status
Spring Rest Docs
Vendor
CVE Published:
9 June 2026

What is CVE-2026-40991?

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.

Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.

Affected Version(s)

Spring REST Docs 4.0.0 < 4.0.1

Spring REST Docs 3.0.0 < 3.0.6

Spring REST Docs 2.0.0.RELEASE < 2.0.9.RELEASE

References

https://spring.io/security/cve-2026-40991

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.