Remote Code Execution Risk in Spring Web Services by Pivotal
CVE-2026-40999

8.6HIGH

Key Information:

Vendor

Spring

Status
Spring Web Services
Vendor
CVE Published:
11 June 2026

What is CVE-2026-40999?

This vulnerability allows Spring Web Services to initiate unsafe outbound connections to unverified destinations when WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses. By taking destination information directly from request headers without adequate validation, attackers could potentially exploit this flaw to send malicious requests or gain unauthorized access to sensitive data. Users are encouraged to review the patched versions to mitigate this risk.

Affected Version(s)

Spring Web Services 5.0.0 < 5.0.1.1

Spring Web Services 4.1.0 < 4.1.3.1

Spring Web Services 4.0.0 < 4.0.19

References

https://spring.io/security/cve-2026-40999

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.