CVE-2026-40997
published 2026-06-11CVE-2026-40997: Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP…
PriorityP334medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.46%
39.2th percentile
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | spring_web_services | < 3.1.9 | 3.1.9 |
| broadcom | spring_web_services | >= 4.0.0 < 4.0.19 | 4.0.19 |
| broadcom | spring_web_services | >= 4.1.0 < 4.1.3.1 | 4.1.3.1 |
| broadcom | spring_web_services | >= 5.0.0 < 5.0.1.1 | 5.0.1.1 |
| spring | spring_web_services | >= 3.1.0 < 3.1.9 | 3.1.9 |
| spring | spring_web_services | >= 4.0.0 < 4.0.19 | 4.0.19 |
| spring | spring_web_services | >= 4.1.0 < 4.1.3.1 | 4.1.3.1 |
| spring | spring_web_services | >= 5.0.0 < 5.0.1.1 | 5.0.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callb
ghsa_unreviewed·2026-06-11
CVE-2026-40997 [MEDIUM] CWE-209 Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callb
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
GHSA
Spring Web Services: SOAP security faults leak Spring Security account state
ghsa·2026-06-11
CVE-2026-40997 [MEDIUM] CWE-209 Spring Web Services: SOAP security faults leak Spring Security account state
Spring Web Services: SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-11
Published