Compliance Impact

The provided information does not specify how CVE-2026-40991 impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-40991 is a Medium-severity XML External Entity (XXE) injection vulnerability that affects Spring REST Docs versions 2.0.0.RELEASE through 4.0.0.

The vulnerability occurs when using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP.

If an attacker compromises the API or tricks a user into documenting a malicious API, they can exploit this flaw to perform an XXE injection attack during the next execution of the documentation-generating tests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to perform an XML External Entity (XXE) injection attack when the documentation-generating tests are executed.

Such an attack can lead to the disclosure of sensitive data, denial of service, or other impacts depending on the XML parser's behavior and the environment.

Because the attack requires either compromising the API or tricking the user into documenting a malicious API, the risk is tied to the trustworthiness of the API being documented.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the risk of the XXE injection vulnerability in Spring REST Docs, you should upgrade to the fixed versions: 2.0.9.RELEASE, 3.0.6, or 4.0.1.

Enterprise support users can also apply patches 2.0.9.RELEASE, 3.0.5.1, or 4.0.0.1.

No additional mitigation steps are required after upgrading.

Useful 0 Not Useful 0