CVE-2026-41000

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8

Description The Wss4jSecurityInterceptor failed to consistently integrate Apache WSS4J ReplayCache instances into RequestData during validation-time checks. This inconsistency renders protections against the replay of UsernameToken nonces and creation timestamps, Timestamp elements, and specific SAML one-time-use semantics ineffective, even if a replay cache is configured on the interceptor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.