Home

Description

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

PUBLISHED Reserved 2026-04-16 | Published 2026-06-11 | Updated 2026-06-11 | Assigner vmware




HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Problem types

CWE-1188: Initialization of a Resource with an Insecure Default

Product status

Default status
unaffected

5.0.0 (custom) before 5.0.2
affected

4.1.0 (custom) before 4.1.4
affected

4.0.0 (custom) before 4.0.19
affected

3.1.0 (custom) before 3.1.9
affected

References

spring.io/security/cve-2026-40994

cve.org (CVE-2026-40994)

nvd.nist.gov (CVE-2026-40994)

Download JSON