Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-40998

Jaxp13 XPath XXE via StreamSource and SAXSource

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Web Services

Default version status: unaffected

  • 5.0.0 to < 5.0.1.1affected
  • 4.1.0 to < 4.1.3.1affected
  • 4.0.0 to < 4.0.19affected
  • 3.1.0 to < 3.1.9affected

References