br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +91 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.0.0, <=4.0.17)

org.springframework.ws:spring-xml MAVEN version =4.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-40998 Source advisory: GHSA-2MPF-M756-HXJM...

cn.openapis:hy.microservice (>=1.21.9, <=1.22.8), com.github.salilvnair:api-processor (1.0.6) +36 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-xml MAVEN version =5.0.0, =1.21.9, =2.0.8, =8.9.0-alpha3, =1.0.0, =5.0.0-beta.1, =1.4.66, =4.19.0, =4.19.0, =8.0.0-rc1, =8.0.0-rc5 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent 5.0.0-m1 - org.citrusframework:citrus-core...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +73 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-xml MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40998 Source advisory: OSV:GHSA-2MPF-M756-HXJM...

CVE-2026-40998

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +73 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-xml MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40998 Source advisory: MEND:CVE-2026-40998...