CVE-2026-41000: VMware Spring Web Services replay attack bypass in Wss4jSecurityInterceptor

CVE-2026-41000 · Severity: low · CVSS 3.7 · Published 2026-06-11

Spring Web Services is a framework for building SOAP-based web services with security features. The Wss4jSecurityInterceptor component failed to properly use configured replay cache protections during validation, allowing attackers to replay previously captured authentication tokens and timestamps to bypass security controls even when a replay cache was configured by the operator.

Technologies: org.springframework.ws:spring-ws-security (Maven), VMware Spring Web Services. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41000 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41000 being exploited in the wild.
How severe is CVE-2026-41000?
Low severity, with a CVSS score of 3.7, published 11 June 2026.
Which products and versions are affected?
org.springframework.ws:spring-ws-security (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.2; VMware Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Is there a fix for CVE-2026-41000?
Yes. org.springframework.ws:spring-ws-security (Maven): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41000 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41000?
Check whether you run org.springframework.ws:spring-ws-security (Maven) or VMware Spring Web Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.ws:spring-ws-security (Maven): upgrade to 5.0.2 or later
    # set org.springframework.ws:spring-ws-security to 5.0.2 in your pom.xml or build.gradle

Technical details

The vulnerability is an authentication bypass through capture-replay attacks (CWE-294) affecting the Wss4jSecurityInterceptor in Spring Web Services. The root cause is that Apache WSS4J ReplayCache instances are not consistently wired into RequestData during validation-time security checks. This means that configured replay protections against UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics are ineffective. An attacker with network access can capture valid SOAP security headers and replay them to the server, bypassing token and timestamp validation controls. The vulnerability requires the ability to intercept and replay network traffic but does not require user interaction or elevated privileges. Patches are available for versions 5.0.2 and later; versions 4.1.4 and later for the 4.1.x branch; no patch information is available for 4.0.x and 3.1.x branches.

Affected products

  • SpringSource Spring Web Services 5.0.0 through 5.0.1
  • SpringSource Spring Web Services 4.1.0 through 4.1.3
  • SpringSource Spring Web Services 4.0.0 through 4.0.18
  • SpringSource Spring Web Services 3.1.0 through 3.1.8

Identifiers

  • CVE-2026-41000
  • GHSA-8qq9-r6cc-qjv9

Timeline

  • 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-08-21: advisory: GitHub reviewed advisory
  • 2026-06-11: patched: Patches released for versions 5.0.2 and 4.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.