CVE-2026-40996: Spring Web Services RSA v1.5 Weak Key Transport Default

Technical summary

The Wss4jSecurityInterceptor in Spring Web Services set allowRSA15KeyTransportAlgorithm to true, contradicting Apache WSS4J's more restrictive default validation behavior for RequestData. This configuration choice allowed the decryption pipeline to accept RSA 1.5 (PKCS#1 v1.5) encrypted session keys, a key transport algorithm vulnerable to padding oracle and other cryptanalytic attacks that are well-understood in academic literature. An attacker with network access and the ability to observe or modify SOAP traffic could potentially craft messages that exploit these weaknesses to recover key material or plaintext. Mitigation requires explicit operator intervention to disable this algorithm acceptance.

Business impact

Web service implementations relying on WS-Security for confidentiality and integrity of SOAP messages are at heightened risk if they have not manually hardened their cryptographic configuration. The exposure is indirect—an attacker must already be in a position to interact with or observe encrypted traffic—but the consequence involves potential exposure of sensitive data transmitted through web services, including database credentials, authentication tokens, or application-specific secrets carried in SOAP payloads. Remediation is straightforward but requires proactive configuration review and testing.

Affected systems

Spring Web Services versions 5.0.0–5.0.1, 4.1.0–4.1.3, 4.0.0–4.0.18, and 3.1.0–3.1.8 are affected. Any organization deploying these versions in production web service endpoints that accept encrypted SOAP requests should be considered in scope. Verify your deployed version and confirm whether your environment processes WS-Security encrypted messages; air-gapped services or endpoints that do not decrypt inbound messages are not vulnerable to exploitation.

Exploitability

Exploitation requires network access to SOAP traffic and the ability to observe or modify encrypted requests—a man-in-the-middle or internal network adversary scenario. The CVSS score of 4.8 reflects these constraints: the attack vector is network-based but access complexity is high. This is not a remote code execution or denial-of-service vector; rather, it is a cryptographic weakness that lowers the bar for key recovery or plaintext extraction under specific attacker positions. Public exploit code is unlikely because the attack depends on the particular encrypted message structure and requires cryptanalytic effort. However, the vulnerability should still be treated as material because RSA v1.5 padding oracle attacks are well-documented and tooling exists.

Remediation

Apply the patch version that addresses this configuration default, available from the Spring Web Services project. Alternatively, if patching is delayed, manually override allowRSA15KeyTransportAlgorithm to false in your Wss4jSecurityInterceptor bean configuration and verify the change via unit or integration testing. After patching or reconfiguration, rotate any cryptographic keys that may have been exposed during the period of vulnerability, particularly session encryption keys and any secrets transmitted via the affected endpoints.

Patch guidance

Consult the Spring Web Services security advisory and project repository for patched versions that restore the safer default (allowRSA15KeyTransportAlgorithm = false). Apply patches to development and test environments first, run your full WS-Security message test suite, and confirm that legitimate clients can still successfully encrypt and decrypt SOAP payloads. Patches for all four affected version branches should be available; prioritize the branch matching your deployment. Verify patch application by inspecting the Wss4jSecurityInterceptor bean instantiation in your running application or by reviewing the source revision.

Detection guidance

Monitor your web service logs and network captures for SOAP messages that include encrypted key transport using RSA 1.5 algorithm identifiers. WS-Security message headers will specify the algorithm OID or URI; RSA v1.5 will appear as 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'. Intrusion detection rules can flag these algorithm choices if your baseline WS-Security traffic should be using RSA-OAEP or other stronger variants. Additionally, review your Spring Web Services configuration files for any explicit allowRSA15KeyTransportAlgorithm property set to true; the absence of this property in patched versions indicates safe defaults.

Why prioritize this

Although the CVSS score is medium (4.8), this vulnerability merits prompt attention because it affects core WS-Security cryptography handling, a trusted path for sensitive data in enterprise service-oriented architectures. The flaw is a deviation from established security best practices, suggesting other misconfigurations may be present in the codebase. The fix is low-risk and straightforward. Organizations with SOA or microservices architectures relying on WS-Security should prioritize this patch in their vulnerability remediation schedule, particularly if they handle payment data, authentication credentials, or other high-value secrets via SOAP.

Risk score, explained

The CVSS 3.1 score of 4.8 (Medium) reflects an attack vector that is network-based, requires high access complexity (attacker must observe or modify encrypted messages in transit), and does not affect system integrity or availability—only confidentiality. The score appropriately weights the practical barriers to exploitation while acknowledging that RSA v1.5 is a known-weak algorithm. In organizations where WS-Security endpoints are not exposed to untrusted networks, or where encrypted traffic is already protected by TLS and application-level access controls, the operational risk may be lower than the CVSS score suggests.

Frequently asked questions