Executive brief
Spring Web Services contains a security component (Wss4jSecurityInterceptor) that validates incoming SOAP messages for cryptographic compliance. Due to a misconfigured default setting, the component fails to enforce WS-I Basic Security Profile (BSP) rules, allowing messages that violate security standards to be accepted. This weakens the integrity of message-level security checks, potentially enabling attackers to craft malicious or non-compliant messages that bypass protocol-level validation.
Technical details
The vulnerability is a configuration initialization flaw (CWE-1188) in the Wss4jSecurityInterceptor component of Spring Web Services. The BSP compliance flag is initialized with an insecure default that disables WS-I Basic Security Profile validation during inbound message processing, specifically affecting WSS4J's RequestData enforcement. This allows messages that violate BSP rules—including improper key derivation, weak algorithms, or malformed security headers—to pass validation checks. An attacker on the network can send crafted WS-Security messages that would normally fail BSP validation but are now accepted due to the disabled check (CWE-1188 - Initialization with Insecure Default). The attack requires network access to the affected service but no authentication or user interaction. Patches are available: version 5.0.2 and 4.1.4 correct the default, while versions 4.0.0–4.0.18 and 3.1.0–3.1.8 remain unpatched.
Affected products
- VMware Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, 3.1.0 through 3.1.8
Timeline
- 2026-06-11: disclosed: Vulnerability published to GitHub Advisory Database and NVD
- 2026: patched: Fixes released in Spring Web Services 5.0.2 and 4.1.4; versions 4.0.0–4.0.18 and 3.1.0–3.1.8 remain unpatched