XML External Entity Injection in Spring Web Services

Compliance Impact

The vulnerability allows attacker-controlled XML to be parsed insecurely, exposing applications to XML External Entity (XXE) attacks. Such attacks could lead to confidential file disclosure or server-side request forgery.

This exposure to unauthorized data access or disclosure could impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding sensitive information against unauthorized access.

Therefore, if exploited, this vulnerability could result in violations of these standards due to potential breaches of confidentiality and data security.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-40998 is a security vulnerability in certain versions of Spring Web Services involving the Jaxp13XPathTemplate component.

This component evaluates XPath expressions for StreamSource and SAXSource inputs using the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration.

As a result, attacker-controlled XML can be parsed with insecure settings, exposing applications to XML External Entity (XXE) attacks.

These XXE attacks can allow attackers to disclose confidential files or perform server-side request forgery depending on the parser and platform behavior.

Useful 0 Not Useful 0

Impact Analysis

If your application evaluates XPath expressions against untrusted XML payloads using the affected versions of Spring Web Services, it could be vulnerable to XXE attacks.

• Confidential file disclosure: Attackers may access sensitive files on the server.
• Server-side request forgery (SSRF): Attackers may cause the server to make unauthorized requests.

These impacts can lead to data breaches, unauthorized access, and potential compromise of the server environment.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended mitigation is to upgrade to the fixed versions of Spring Web Services.

• Upgrade to 5.0.2 (OSS) or 5.0.1.1 (Enterprise Support Only) for 5.0.x versions.
• Upgrade to 4.1.4 (OSS) or 4.1.3.1 (Enterprise Support Only) for 4.1.x versions.
• Upgrade to 4.0.19 (Enterprise Support Only) for 4.0.x versions.
• Upgrade to 3.1.9 (Enterprise Support Only) for 3.1.x versions.

No additional mitigation steps are necessary after upgrading.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of Jaxp13XPathTemplate evaluating XPath expressions with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration, exposing applications to XXE attacks when processing untrusted XML payloads.

Detection typically involves identifying if your system is running an affected version of Spring Web Services (versions 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, or 5.0.0 through 5.0.1) and if your application evaluates XPath expressions on untrusted XML inputs using Jaxp13XPathTemplate.

Since the vulnerability is related to XML parsing behavior, network detection might involve monitoring for suspicious XML payloads that attempt XXE exploitation patterns.

No specific detection commands or scanning tools are provided in the available resources.

Useful 0 Not Useful 0