CVE-2026-40996

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8

Description Wss4jSecurityInterceptor sets the allowRSA15KeyTransportAlgorithm variable to true by default, which overrides the safer default provided by Apache WSS4J for validation RequestData. Consequently, inbound WS-Security decryption may accept RSA PKCS#1 v1.5 (rsa-1 5) encrypted key material unless the flag is explicitly reconfigured.

Recommendations For versions 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, and 3.1.0 through 3.1.8, explicitly reconfigure the allowRSA15KeyTransportAlgorithm flag to false. At the moment, there is no information about a newer version that contains a fix for this vulnerability.