CVE-2026-40998: Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's…

PriorityP351high8.2CVSS 3.1

AVNACLPRNUINSUCHILAN

EPSS

0.39%

31.5th percentile

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
broadcom	spring_web_services	< 3.1.9	3.1.9
broadcom	spring_web_services	>= 4.0.0 < 4.0.19	4.0.19
broadcom	spring_web_services	>= 4.1.0 < 4.1.3.1	4.1.3.1
broadcom	spring_web_services	>= 5.0.0 < 5.0.1.1	5.0.1.1
spring	spring_web_services	>= 3.1.0 < 3.1.9	3.1.9
spring	spring_web_services	>= 4.0.0 < 4.0.19	4.0.19
spring	spring_web_services	>= 4.1.0 < 4.1.3.1	4.1.3.1
spring	spring_web_services	>= 5.0.0 < 5.0.1.1	5.0.1.1

CVSS provenance

nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vendor_redhat8.2HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.