CVE-2026-41000
published 2026-06-11CVE-2026-41000: Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections…
PriorityP417low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.22%
13.0th percentile
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_web_services | >= 3.1.0 < 3.1.9 | 3.1.9 |
| spring | spring_web_services | >= 4.0.0 < 4.0.19 | 4.0.19 |
| spring | spring_web_services | >= 4.1.0 < 4.1.3.1 | 4.1.3.1 |
| spring | spring_web_services | >= 5.0.0 < 5.0.1.1 | 5.0.1.1 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks.
ghsa_unreviewed·2026-06-11
CVE-2026-41000 [LOW] CWE-294 Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks.
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Red Hat
Spring Web Services: Spring Web Services: Replay protection bypass due to improper cache integration
vendor_redhat·2026-06-11·CVSS 3.7
CVE-2026-41000 [LOW] CWE-294 Spring Web Services: Spring Web Services: Replay protection bypass due to improper cache integration
Spring Web Services: Spring Web Services: Replay protection bypass due to improper cache integration
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
A flaw was found in Spring Web Services. The security interceptor in the affected component did not properly integrate replay cache mechanisms. This vulnerability could allow a remote attacker to bypass rep
No detection rules found.
No public exploits indexed.
2026-06-11
Published