CVE-2026-40999: VMware Spring Web Services SSRF via WS-Addressing headers

CVE-2026-40999 · Severity: high · CVSS 8.6 · Published 2026-06-11

Spring Web Services, a framework for building SOAP-based web services, fails to validate destination addresses supplied in WS-Addressing headers. An unauthenticated attacker can inject malicious reply-to or fault-to addresses in requests, causing the server to initiate outbound connections to arbitrary internal or external systems. This enables reconnaissance of internal networks, data exfiltration, or attacks on systems that the vulnerable server can reach.

Technologies: VMware Spring Web Services. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-40999 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40999 being exploited in the wild.
How severe is CVE-2026-40999?
High severity, with a CVSS score of 8.6, published 11 June 2026.
Which products and versions are affected?
org.springframework.ws:spring-ws-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.2; VMware Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Is there a fix for CVE-2026-40999?
Yes. org.springframework.ws:spring-ws-core (Maven): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40999 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40999?
Check whether you run org.springframework.ws:spring-ws-core (Maven) or VMware Spring Web Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.ws:spring-ws-core (Maven): upgrade to 5.0.2 or later
    # set org.springframework.ws:spring-ws-core to 5.0.2 in your pom.xml or build.gradle

Technical details

This is a Server-Side Request Forgery (SSRF) vulnerability in the WS-Addressing support of Spring Web Services. The root cause is insufficient validation of ReplyTo and FaultTo URI addresses parsed from incoming SOAP requests. When WS-Addressing is enabled with non-anonymous reply destinations, Spring WS directly uses request-supplied URIs to initiate outbound connections via configured WebServiceMessageSender instances without verifying that those destinations are safe to connect to. The attack requires network access to the vulnerable service but no prior authentication or user interaction. An attacker can craft SOAP requests with malicious WS-Addressing headers to trigger connections to internal IP ranges, private networks, or sensitive services. Patches have been released in versions 5.0.2 and 4.1.4; earlier versions (4.0.0-4.0.18 and 3.1.0-3.1.8) have no documented patches. The fix introduces a DestinationPolicy validation framework with transport-specific checks and stricter defaults (e.g., blocking RFC 1918 private addresses and disabling DNS resolution in HTTP senders by default).

Affected products

  • Spring Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, 3.1.0 through 3.1.8

Identifiers

  • CVE-2026-40999
  • GHSA-whpp-xv3h-rwxf

Timeline

  • 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-06-09: patched: Fix commit 5121a4e released; patched versions 5.0.2 and 4.1.4 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.