CVE-2026-40994

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8

Description The Wss4jSecurityInterceptor initializes its WS-I Basic Security Profile (BSP) compliance flag in a way that disables WSS4J BSP enforcement on RequestData during inbound validation. This allows services that validate WS-Security on the network to accept messages that violate BSP rules, which weakens protocol-level checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.