K000162183: Spring web services vulnerability CVE-2026-40996

Security Advisory Description Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators...

CVE-2026-40996

creationtimestamp| type| source ---|---|--- 2026-06-11 12:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaoi3n5f2d...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40996 Source advisory: GHSA-P7QJ-2Q5W-F9R7...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40996 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320523...

Azure Linux 3.0 Security Update: kernel (CVE-2024-40996)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-40996 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskbpullreason...

MAL-2025-40996 Malicious code in zinnia_y1ogc_uiuw5_firefly (npm)

The package zinniay1ogcuiuw5firefly was found to contain malicious code...

CVE-2024-40996 affecting package kernel for versions less than 6.6.47.1-1

CVE-2024-40996 affecting package kernel for versions less than 6.6.47.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-40996

A vulnerability found in the Linux kernel’s bpf subsystem, involving a frequent warning splat in pskbmaypull during syzkaller builds CONFIGDEBUGNET=y, has been resolved. The warning, caused by nonsensical BPF programs generated by fuzzers, was suppressed as it provided no useful information. For...

SUSE CVE-2024-40996

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskbpullreason syzkaller builds CONFIGDEBUGNET=y frequently trigger a debug hint in pskbmaypull. We'd like to retain this debug check because it might hint at integer overflows and other issues kernel code...

BELL-CVE-2024-40996

Bulletin has no description...

UBUNTU-CVE-2024-40996

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskbpullreason syzkaller builds CONFIGDEBUGNET=y frequently trigger a debug hint in pskbmaypull. We'd like to retain this debug check because it might hint at integer overflows and other issues kernel code...

CVE-2024-40996

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskbpullreason syzkaller builds CONFIGDEBUGNET=y frequently trigger a debug hint in pskbmaypull. We'd like to retain this debug check because it might hint at integer overflows and other issues kernel code...

CVE-2024-40996 bpf: Avoid splat in pskb_pull_reason

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskbpullreason syzkaller builds CONFIGDEBUGNET=y frequently trigger a debug hint in pskbmaypull. We'd like to retain this debug check because it might hint at integer overflows and other issues kernel code...

CVE-2024-40996 bpf: Avoid splat in pskb_pull_reason

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskbpullreason syzkaller builds CONFIGDEBUGNET=y frequently trigger a debug hint in pskbmaypull. We'd like to retain this debug check because it might hint at integer overflows and other issues kernel code...

CVE-2022-40996

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these...

CVE-2022-40996

The TALOS-2022-1613 report details CVE-2022-40996 affecting Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. The vulnerability is a stack-based buffer overflow in the DetranCLI command parsing framework, specifically within a command template such as no firmwall srcmac/srcip/dstip/protocol/srcport/dst...

CVE-2021-40996

creationtimestamp| type| source ---|---|--- 2021-10-15 18:28:45+00:00| seen| https://t.me/cibsecurity/30633...

CVE-2021-40996

CVE-2021-40996 affects Aruba ClearPass Policy Manager. Remote authentication bypass vulnerability documented for ClearPass Policy Manager 6.10.x before 6.10.2, 6.9.x before 6.9.7-HF1, and 6.8.x before 6.8.9-HF1. Aruba released patches addressing this vulnerability; the issue arises in the web man...