CVE-2026-40999: Spring WS Server-Side Request Forgery via WS-Addressing (CVSS 8.6)

Technical summary

CVE-2026-40999 exploits unsafe handling of WS-Addressing non-anonymous endpoints in Spring WS. The vulnerability stems from the library's WebServiceMessageSender instances processing ReplyTo and FaultTo header values without destination validation. When WS-Addressing is enabled and a SOAP message includes these headers pointing to attacker-controlled URLs, Spring WS will initiate outbound HTTP(S) connections to those addresses directly from the request data. The flaw affects versions 3.1.0–3.1.8, 4.0.0–4.0.18, 4.1.0–4.1.3, and 5.0.0–5.0.1. The CWE-918 classification (Server-Side Request Forgery) correctly captures the core issue: attacker-directed outbound connections initiated by the application server.

Business impact

Organizations using Spring WS are exposed to SSRF attacks that can: (1) allow attackers to map internal network topology and probe services behind firewalls; (2) trigger outbound connections that appear to originate from your servers, potentially triggering alarms or blocking; (3) interact with internal APIs or databases on behalf of the attacker; (4) in some configurations, enable data exfiltration or lateral movement. Since this requires only network access to send a SOAP request—no authentication—any Internet-facing WS endpoint is a potential attack surface. Compliance and incident response teams should treat this as high-priority for any organization exposing WS-Addressing-enabled endpoints.

Affected systems

Spring Web Services versions 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1 are vulnerable. Organizations should scan their dependency manifests (Maven pom.xml, Gradle build.gradle, etc.) for org.springframework.ws:spring-ws-core or related Spring WS artifacts in these ranges. Applications that do not explicitly enable WS-Addressing or do not expose SOAP endpoints are not affected. Java applications and Spring Boot projects that embed Spring WS for web services are the primary targets.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.6 (HIGH) with an attack vector of Network, requiring no privileges or user interaction. Exploitability is straightforward: an attacker sends a crafted SOAP message to any exposed WS-Addressing endpoint with a malicious ReplyTo or FaultTo address. No special tooling or deep knowledge is required—standard SOAP client libraries or even hand-crafted XML suffice. The lack of authentication requirements and low complexity make this a practical target for opportunistic attackers scanning for vulnerable endpoints. However, the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not yet been widely reported.

Remediation

Upgrade Spring Web Services to a patched version as soon as possible. Verify against the official Spring WS security advisories for the exact patch versions addressing this CVE. In parallel, implement input validation at the application level: if you control the WS code, validate that ReplyTo and FaultTo addresses conform to an allowlist of safe domains or disable non-anonymous addressing if not required. Network-level mitigations include restricting outbound connections from application servers to only approved destinations and monitoring for unexpected external connections.

Patch guidance

Check the Spring Security advisories and Spring WS release notes for patched versions that address CVE-2026-40999. Typically, vendors release patch versions in the next minor or patch release after vulnerability disclosure. For version 3.1.x, 4.0.x, 4.1.x, and 5.0.x lines, consult the official Spring Projects repository and security page to identify the specific patched release. After patching, restart all Java application servers running Spring WS to ensure the new library is loaded. Consider a staged rollout to validate compatibility with your SOAP clients before full production deployment.

Detection guidance

Monitor application logs and network traffic for signs of exploitation: (1) Outbound SOAP/HTTP connections initiated to unusual or external destinations not in your normal traffic patterns; (2) SOAP requests containing ReplyTo or FaultTo headers pointing to non-internal addresses; (3) WebServiceMessageSender exceptions or warnings related to unexpected connection attempts. Security Information and Event Management (SIEM) systems should flag outbound connections from application servers to Internet hosts outside approved ranges. If WS-Addressing is not required, disable it in your Spring WS configuration to eliminate the attack surface entirely.

Why prioritize this

This vulnerability merits immediate attention because: (1) CVSS 8.6 (HIGH) severity with unauthenticated, network-accessible attack surface; (2) SSRF vulnerabilities are actively exploited and frequently chained with other attacks; (3) many organizations are unaware of Spring WS deployments embedded in larger applications; (4) the fix is vendor-provided and straightforward to apply. While not yet in the KEV catalog, the risk profile and ease of exploitation justify fast-track remediation ahead of routine patching cycles.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects: Attack Vector (Network) = highly accessible; Attack Complexity (Low) = no special conditions; Privileges Required (None) = unauthenticated exploitation; User Interaction (None) = attacker acts alone; Scope (Changed) = the impact extends beyond the vulnerable component to internal systems; Confidentiality (High) = sensitive data may be disclosed; Integrity (None) = no direct modification; Availability (None) = no denial of service. The score appropriately emphasizes the SSRF nature and potential for information disclosure or lateral movement, placing it in the HIGH category.

Frequently asked questions