Executive brief
Spring Web Services is a framework for building SOAP-based web services. A configuration default allows the system to accept weak RSA encryption algorithms for decrypting message keys, which cryptographic standards now recommend against. An attacker with network access could exploit this to decrypt inbound WS-Security messages or potentially forge signed messages, compromising the confidentiality and integrity of sensitive data exchanged via these web services.
Technical details
This vulnerability exists in Spring Web Services' Wss4jSecurityInterceptor, which handles WS-Security processing for SOAP messages. The component defaulted the allowRSA15KeyTransportAlgorithm flag to true, overriding Apache WSS4J library's safer default for RequestData validation. This allows the framework to accept RSA PKCS#1 v1.5 (rsa-1_5) padding for encrypted key material during inbound message processing. RSA PKCS#1 v1.5 padding is cryptographically weaker than modern alternatives (OAEP) and subject to known padding oracle attacks. Exploitation requires network access to a vulnerable endpoint and knowledge of the public key, but no authentication is required. An attacker can mount decryption oracle attacks to recover encrypted key material or forge messages. Patches are available in versions 5.0.2 and 4.1.4; versions 4.0.0–4.0.18 and 3.1.0–3.1.8 are end-of-life without patches.
Affected products
- Spring Web Services 5.0.0 through 5.0.1
- Spring Web Services 4.1.0 through 4.1.3
- Spring Web Services 4.0.0 through 4.0.18
- Spring Web Services 3.1.0 through 3.1.8
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-11: patched: Fixes available in Spring Web Services 5.0.2 and 4.1.4