# CVE-2026-40998: VMware Spring Web Services XXE in Jaxp13XPathTemplate

Source: https://junglewise.ai/threats/cve-2026-40998-vmware-spring-web-services-xxe-in-jaxp13xpathtemplate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-40998 · Severity: high · CVSS 8.2 · Published 2026-06-11

Spring Web Services is a framework used to build SOAP web services and process XML documents. The Jaxp13XPathTemplate component incorrectly parses untrusted XML using Java's default XML parser instead of Spring's hardened configuration, allowing attackers to exploit XML External Entity (XXE) vulnerabilities. An attacker who can submit malicious XML payloads to an application evaluating XPath expressions could read sensitive files or conduct denial-of-service attacks.

Technologies: [VMware Spring Web Services](https://junglewise.ai/threats/technologies/web-services). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Spring](https://junglewise.ai/threats/vendors/spring), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-40998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40998 being exploited in the wild.

**How severe is CVE-2026-40998?** High severity, with a CVSS score of 8.2, published 11 June 2026.

**Which products and versions are affected?** org.springframework.ws:spring-xml (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.2; Spring-Xml 5.0.0 to 5.0.1; VMware Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

**Is there a fix for CVE-2026-40998?** Yes. org.springframework.ws:spring-xml (Maven): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40998 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40998?** Check whether you run org.springframework.ws:spring-xml (Maven), Spring-Xml or VMware Spring Web Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.ws:spring-xml (Maven): upgrade to 5.0.2 or later

  ```sh
  # set org.springframework.ws:spring-xml to 5.0.2 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in the Jaxp13XPathTemplate class, which evaluates XPath expressions against XML documents provided as StreamSource or SAXSource inputs. The vulnerable code path uses XPath.evaluate() with an InputSource, which internally invokes the JDK's default DocumentBuilderFactory without Spring's XXE-hardening configurations (external entity expansion disabled, DTD processing disabled, etc.). This allows an attacker submitting XML containing malicious DOCTYPE declarations and entity references to trigger XXE attacks. The attacker requires the ability to provide XML input to the XPath evaluation function; no authentication or elevated privileges are required. Successful exploitation enables arbitrary file read, SSRF, or denial-of-service. Patches are available: versions 5.0.2, 4.1.4, and later versions of 4.0.x and 3.1.x series include fixes that use Spring's hardened DocumentBuilderFactory utility and bypass unsafe InputSource-only parsing.

## Affected products

- Spring spring-xml 5.0.0 to 5.0.1
- Spring spring-xml 4.1.0 to 4.1.3
- Spring spring-xml 4.0.0 to 4.0.18
- Spring spring-xml 3.1.0 to 3.1.8

## Identifiers

- CVE-2026-40998
- GHSA-2mpf-m756-hxjm

## Timeline

- 2026-06-11: disclosed: Published in GitHub Advisory Database
- 2026-06-09: patched: Fix committed to spring-projects/spring-ws (versions 5.0.2, 4.1.4 and later)

## References

- [https://spring.io/security/cve-2026-40998](https://spring.io/security/cve-2026-40998)
- [https://github.com/spring-projects/spring-ws/commit/eb8d66c0995d1e1dd5bfcfb657c8c9de21266d97](https://github.com/spring-projects/spring-ws/commit/eb8d66c0995d1e1dd5bfcfb657c8c9de21266d97)

## Related threats

- [VMware Spring Web Services replay attack bypass in Wss4jSecurityInterceptor](https://junglewise.ai/threats/cve-2026-41000-vmware-spring-web-services-replay-attack-bypass-in)
- [VMware Spring Web Services SSRF via WS-Addressing headers](https://junglewise.ai/threats/cve-2026-40999-vmware-spring-web-services-ssrf-via-ws-addressing-headers)
- [VMware Spring Web Services information disclosure in Spring Security integration](https://junglewise.ai/threats/cve-2026-40997-vmware-spring-web-services-information-disclosure-in-spring)
- [VMware Spring Web Services insecure default in Wss4jSecurityInterceptor](https://junglewise.ai/threats/cve-2026-40996-vmware-spring-web-services-insecure-default-in)
- [VMware Spring Web Services improper authentication in X509AuthenticationProvider](https://junglewise.ai/threats/cve-2026-40995-vmware-spring-web-services-improper-authentication-in)