CVE-2026-40991

Name of the Vulnerable Software and Affected Versions Spring REST Docs version 4.0.0 Spring REST Docs versions 3.0.0 through 3.0.5 Spring REST Docs versions 2.0.0.RELEASE through 2.0.8.RELEASE

Description An XXE (XML External Entity) injection attack can occur when using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP. An attacker who compromises the API or tricks a user into documenting a malicious API can trigger this attack during the execution of documentation-generating tests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.