Broadcom Spring Web Services vulnerabilities

8 CVEs affecting Broadcom Spring Web Services, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41000, published 2026-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3773, published 2019-01-18. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted…
CVE-2026-40997, published 2026-06-11. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or…
CVE-2026-40999, published 2026-06-11. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken…
CVE-2026-40998, published 2026-06-11. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior…
CVE-2026-40994, published 2026-06-11. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security…
CVE-2026-41000, published 2026-06-11. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and…
CVE-2026-40995, published 2026-06-11. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle…
CVE-2026-40996, published 2026-06-11. Medium severity, CVSS 4.8. EPSS: 0.1% chance of exploitation in the next 30 days. Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept…