CVE Almanac
← All CVEs

CVE-2026-40998

HIGH 8.2

Published 2026-06-11 · Last modified 2026-06-23

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

ELEVATED IMPACT

Severe if exploited (CVSS 8.2), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 27th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.2CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Spring

Products Spring Web Services

Weakness (CWE)

  • CWE-611: XML external entity (XXE)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

Technical & other

Sources: NVD · CVE.org · EPSS