CVE-2026-40998: Spring Web Services XXE via Jaxp13XPathTemplate – Patch Guidance

Technical summary

The Jaxp13XPathTemplate class in affected Spring Web Services versions fails to apply the framework's hardened DocumentBuilderFactory configuration when processing StreamSource and SAXSource inputs. Instead, it delegates to the JDK's default DocumentBuilderFactory, which permits XML External Entity (XXE) expansion by default. When untrusted XML payloads are parsed during XPath evaluation, attackers can define external entities that retrieve arbitrary files or interact with internal services. The vulnerability stems from a code path that was not retrofitted with Spring's XXE protections, leaving a bypass vector for applications that evaluate XPath expressions against user-supplied XML.

Business impact

Organizations using affected versions face exposure of confidential data if their applications process XPath queries on untrusted XML—a common scenario in XML-based APIs, SOAP services, and content transformation pipelines. Attackers can exfiltrate sensitive files accessible to the application server, internal configuration details, or trigger Server-Side Request Forgery (SSRF) attacks to probe internal infrastructure. This is particularly acute in multi-tenant environments or API gateways where user input flows directly into XPath evaluation. Financial services, healthcare, and government agencies relying on Spring Web Services for SOAP or XML processing should prioritize assessment.

Affected systems

Spring Web Services versions 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1 are vulnerable. Any application instantiating or using Jaxp13XPathTemplate directly, or indirectly through Spring Web Services' XPath-based features (such as WS-Addressing or custom XPath filters), inherits the risk. Organizations should audit all Spring Web Services deployments and check which minor versions are in use, as vulnerability spans multiple product release tracks.

Exploitability

The vulnerability requires network access and no authentication—an attacker need only send a crafted XML payload to an endpoint that evaluates XPath expressions. The attack surface is high because XXE exploitation is straightforward: simple XML syntax like entity definitions are sufficient to trigger file reads or network callbacks. However, exploitability depends on whether the application actually parses untrusted XML through the vulnerable code path; applications that validate or sanitize XML before XPath evaluation, or that never use XPath on user input, face lower practical risk. No known public exploits have been disclosed at the time of publication, but the technical barrier to weaponization is low.

Remediation

Apply vendor patches immediately. Spring Web Services has released patched versions for all affected tracks: verify and deploy the latest 3.1.x, 4.0.x, 4.1.x, or 5.0.x patch release for your version line. As a temporary mitigation, if patching is delayed, implement input validation to reject XML payloads containing entity declarations or DOCTYPE definitions before they reach XPath evaluation. Additionally, run your application under a Java security manager with restrictive permissions to limit file system and network access, and disable external entity resolution at the JVM level if feasible (though this is a defense-in-depth measure, not a substitute for patching).

Patch guidance

Check the Spring Web Services project release notes and security advisories for the specific patch version corresponding to your current deployment version. Patches are expected for the 3.1.8, 4.0.18, 4.1.3, and 5.0.1 patch releases or their successors. Verify the patch against the vendor advisory to confirm that Jaxp13XPathTemplate now applies Spring's hardened DocumentBuilderFactory configuration. Test patched versions in a staging environment before production rollout, particularly if you rely on custom XPath expressions or WS-Addressing features. Plan for a phased deployment starting with non-production systems to catch compatibility issues.

Detection guidance

Monitor application logs for XML parsing errors or exceptions originating from XPath evaluation code paths. Look for DOCTYPE declarations, ENTITY keywords, or file:// protocol references in incoming XML payloads sent to endpoints that perform XPath queries. Deploy WAF rules or API gateway filters to block XML with external entity declarations. Conduct code review of all Spring Web Services configuration to identify uses of Jaxp13XPathTemplate or XPath-related Spring Web Services features. Intrusion detection systems should flag attempts to access system files (e.g., /etc/passwd) via XXE payloads, though XXE attacks are often silent if the attacker uses out-of-band data exfiltration. Perform static analysis on your codebase to pinpoint where XPath expressions are evaluated against potentially untrusted input.

Why prioritize this

With a CVSS 3.1 score of 8.2 (HIGH severity), broad network accessibility, and straightforward exploitation, this vulnerability warrants urgent remediation. While it does not appear on the KEV catalog as of publication, the combination of high confidentiality impact and low attack complexity makes it attractive to threat actors targeting data exfiltration. Organizations running Spring Web Services in production, especially those that expose XPath or SOAP-based APIs, should patch within days rather than weeks. The vulnerability does not require user interaction or privilege escalation, reducing friction for attacks at scale.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The impact is scoped to a single user context (S:U) with high confidentiality breach potential (C:H)—attackers can read arbitrary files—and low integrity impact (I:L), as XXE can sometimes be chained with other techniques to modify data. The absence of availability impact (A:N) reflects that XXE typically does not crash services. The score aligns with the realistic threat posed by XXE vulnerabilities in widely-deployed XML processing frameworks.

Frequently asked questions