CVE-2026-40998

published 2026-06-11

CVE-2026-40998: Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's…

Priority P3 50 high 8.2 CVSS 3.1

AV N AC L PR N UI N S U C H I L A N

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.

Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
spring	spring_web_services	>= 3.1.0 < 3.1.9	3.1.9
spring	spring_web_services	>= 4.0.0 < 4.0.19	4.0.19
spring	spring_web_services	>= 4.1.0 < 4.1.3.1	4.1.3.1
spring	spring_web_services	>= 5.0.0 < 5.0.1.1	5.0.1.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611