CVE-2026-40994
published 2026-06-11CVE-2026-40994: Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on…
PriorityP349high8.2CVSS 3.1
AVNACLPRNUINSUCLIHAN
EPSS
0.34%
26.1th percentile
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | spring_web_services | < 3.1.9 | 3.1.9 |
| broadcom | spring_web_services | >= 4.0.0 < 4.0.19 | 4.0.19 |
| broadcom | spring_web_services | >= 4.1.0 < 4.1.3.1 | 4.1.3.1 |
| broadcom | spring_web_services | >= 5.0.0 < 5.0.1.1 | 5.0.1.1 |
| spring | spring_web_services | >= 3.1.0 < 3.1.9 | 3.1.9 |
| spring | spring_web_services | >= 4.0.0 < 4.0.19 | 4.0.19 |
| spring | spring_web_services | >= 4.1.0 < 4.1.3.1 | 4.1.3.1 |
| spring | spring_web_services | >= 5.0.0 < 5.0.1.1 | 5.0.1.1 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.springframework.ws/spring-ws-security: Spring Web Services: Weakening of WS-Security protocol checks due to disabled BSP enforcement
vendor_redhat·2026-06-11·CVSS 8.2
CVE-2026-40994 [HIGH] CWE-358 org.springframework.ws/spring-ws-security: Spring Web Services: Weakening of WS-Security protocol checks due to disabled BSP enforcement
org.springframework.ws/spring-ws-security: Spring Web Services: Weakening of WS-Security protocol checks due to disabled BSP enforcement
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
A flaw was found in Spring Web Services. The Wss4jSecurityInterceptor component incorrectly initialized its WS-I Basic Security Profile (BSP) compliance flag, which disabled BSP enforcement during inbound validation on RequestData. T
VulDB
Vmware Spring Web Services up to 3.1.8/4.0.18/4.1.3/5.0.1 insecure default initialization of resource (CNNVD-202606-3064)
vuldb·2026-06-13·CVSS 8.2
CVE-2026-40994 [HIGH] Vmware Spring Web Services up to 3.1.8/4.0.18/4.1.3/5.0.1 insecure default initialization of resource (CNNVD-202606-3064)
A vulnerability has been found in Vmware Spring Web Services up to 3.1.8/4.0.18/4.1.3/5.0.1 and classified as critical. This affects an unknown function. This manipulation causes insecure default initialization of resource.
This vulnerability is registered as CVE-2026-40994. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
GHSA
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
ghsa·2026-06-11
CVE-2026-40994 [HIGH] CWE-1188 Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
GHSA
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData.
ghsa_unreviewed·2026-06-11
CVE-2026-40994 [HIGH] CWE-1188 Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData.
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
No detection rules found.
No public exploits indexed.
2026-06-11
Published