Weak RSA PKCS#1 v1.5 Key Transport in Spring Web Services

Executive Summary

CVE-2026-40996 is a security vulnerability in Spring Web Services where the default setting of Wss4jSecurityInterceptor allowed the use of the RSA PKCS#1 v1.5 key transport algorithm by default. This setting overrides Apache WSS4J's safer default configuration for validating RequestData.

Because of this, inbound WS-Security decryption could accept RSA PKCS#1 v1.5 encrypted key material unless operators explicitly changed the configuration. This weaker algorithm can be exploited in man-in-the-middle or oracle-capable attack scenarios when XML encryption or key transport is handled by WSS4J through Spring WS.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if your Spring Web Services deployment is using affected versions and if the Wss4jSecurityInterceptor is configured with the default allowRSA15KeyTransportAlgorithm set to true.

Since the vulnerability relates to inbound WS-Security decryption accepting RSA PKCS#1 v1.5 encrypted key material, you can monitor network traffic for WS-Security messages that use RSA v1.5 key transport algorithms.

Commands or methods to detect this might include:

• Using network packet capture tools like tcpdump or Wireshark to filter and inspect SOAP messages for RSA v1.5 key transport usage.
• Searching your application configuration or logs for the presence of Wss4jSecurityInterceptor and checking if the allowRSA15KeyTransportAlgorithm flag is set to true.
• Using grep or similar commands to find configuration files or code snippets that set allowRSA15KeyTransportAlgorithm, for example: grep -r "allowRSA15KeyTransportAlgorithm" /path/to/your/app

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose systems to cryptographic attacks that exploit the weaker RSA PKCS#1 v1.5 key transport algorithm. Attackers positioned as man-in-the-middle or with oracle capabilities could potentially decrypt or manipulate encrypted communications that rely on this algorithm.

Such attacks could lead to unauthorized access to sensitive data transmitted via WS-Security, undermining confidentiality and integrity of the communication.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-40996 directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation steps are:

• Upgrade your Spring Web Services to fixed versions: 5.0.2, 4.1.4, 4.0.19, or 3.1.9 depending on your release line.
• If upgrading is not possible immediately, explicitly disable RSA PKCS#1 v1.5 encryption by calling setAllowRSA15KeyTransportAlgorithm(false) on the Wss4jSecurityInterceptor configuration.

Useful 0 Not Useful 0