io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-41000 Source advisory: MEND:CVE-2026-41000...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-41000 Source advisory: MEND:CVE-2026-41000...

cn.openapis:hy.microservice (>=1.21.9, <=1.22.8), com.github.salilvnair:api-processor (1.0.6) +29 more potentially affected by CVE-2026-40999 via org.springframework.ws:spring-ws-core (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-core MAVEN version =5.0.0, =1.21.9, =2.0.8, =8.9.0-alpha3, =1.0.0, =5.0.0-beta.1, =1.4.66, =4.19.0, =4.19.0, =8.0.0-rc1, =8.0.0-rc5 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 -...

CVE-2026-40999 Spring WS SSRF via unvalidated WS-Addressing reply destinations

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affect...

CVE-2026-40999

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affect...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +66 more potentially affected by CVE-2026-40999 via org.springframework.ws:spring-ws-core (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-core MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40999 Source advisory: MEND:CVE-2026-40999...

CVE-2026-40997

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40997 Source advisory: MEND:CVE-2026-40997...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40997 Source advisory: MEND:CVE-2026-40997...

CVE-2026-40996 Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators explicitly reconfigured the flag...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40996 Source advisory: MEND:CVE-2026-40996...

CVE-2026-40996

CVE-2026-40996 affects Spring Web Services where Wss4jSecurityInterceptor incorrectly defaults allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J’s safer validation behavior for RequestData. This could allow RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material in inbound WS-Security dec...

CVE-2026-40996

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators explicitly reconfigured the flag...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40996 Source advisory: MEND:CVE-2026-40996...

CVE-2026-40996 Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators explicitly reconfigured the flag...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40995 Source advisory: MEND:CVE-2026-40995...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40995 Source advisory: MEND:CVE-2026-40995...

EUVD-2026-36204

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

CVE-2026-40994 Wss4jSecurityInterceptor disables WS-I BSP validation by default

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40994 Source advisory: MEND:CVE-2026-40994...