CVE-2026-40994: VMware Spring Web Services insecure default in Wss4jSecurityInterceptor

CVE-2026-40994 · Severity: high · CVSS 8.2 · Published 2026-06-11

Spring Web Services contains a security component (Wss4jSecurityInterceptor) that validates incoming SOAP messages for cryptographic compliance. Due to a misconfigured default setting, the component fails to enforce WS-I Basic Security Profile (BSP) rules, allowing messages that violate security standards to be accepted. This weakens the integrity of message-level security checks, potentially enabling attackers to craft malicious or non-compliant messages that bypass protocol-level validation.

Technologies: org.springframework.ws:spring-ws-security (Maven), VMware Spring Web Services. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-40994 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40994 being exploited in the wild.
How severe is CVE-2026-40994?
High severity, with a CVSS score of 8.2, published 11 June 2026.
Which products and versions are affected?
org.springframework.ws:spring-ws-security (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.2; VMware Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, 3.1.0 through 3.1.8, 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Is there a fix for CVE-2026-40994?
Yes. org.springframework.ws:spring-ws-security (Maven): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40994 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40994?
Check whether you run org.springframework.ws:spring-ws-security (Maven) or VMware Spring Web Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.ws:spring-ws-security (Maven): upgrade to 5.0.2 or later
    # set org.springframework.ws:spring-ws-security to 5.0.2 in your pom.xml or build.gradle

Technical details

The vulnerability is a configuration initialization flaw (CWE-1188) in the Wss4jSecurityInterceptor component of Spring Web Services. The BSP compliance flag is initialized with an insecure default that disables WS-I Basic Security Profile validation during inbound message processing, specifically affecting WSS4J's RequestData enforcement. This allows messages that violate BSP rules—including improper key derivation, weak algorithms, or malformed security headers—to pass validation checks. An attacker on the network can send crafted WS-Security messages that would normally fail BSP validation but are now accepted due to the disabled check (CWE-1188 - Initialization with Insecure Default). The attack requires network access to the affected service but no authentication or user interaction. Patches are available: version 5.0.2 and 4.1.4 correct the default, while versions 4.0.0–4.0.18 and 3.1.0–3.1.8 remain unpatched.

Affected products

  • VMware Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, 3.1.0 through 3.1.8

Identifiers

  • CVE-2026-40994
  • GHSA-gg9r-wr4p-w63h

Timeline

  • 2026-06-11: disclosed: Vulnerability published to GitHub Advisory Database and NVD
  • 2026: patched: Fixes released in Spring Web Services 5.0.2 and 4.1.4; versions 4.0.0–4.0.18 and 3.1.0–3.1.8 remain unpatched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.