K000163050: Spring REST Docs vulnerability CVE-2026-40991

Security Advisory Description When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the...

ROOT-APP-MAVEN-CVE-2026-40991 CVE-2026-40991 in io.root.org.springframework.restdocs:spring-restdocs-restassured - Patched by Root

Root has patched CVE-2026-40991 in the io.root.org.springframework.restdocs:spring-restdocs-restassured package for Root:Maven. Multiple fixed versions available...

com.epages:restdocs-api-spec-restassured (>=0.11.2, <=0.16.4), org.springframework.boot:spring-boot-docs (>=2.0.0.release, <=2.1.18.release) +1 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=2.0.0.release, <=2.0.5.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =2.0.0.release, =0.11.2, =2.0.0.release, =2.0.0, =2.2.1 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

org.tuxdevelop:spring-batch-lightmin-documentation (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (1.1.3.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-restassured and may be impacted: -...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

CVE-2026-40991

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

CVE-2026-40991: Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

CVE-2026-40991

The CVE-2026-40991 issue affects Spring REST Docs: 4.0.0; 3.0.0–3.0.5; and 2.0.0.RELEASE–2.0.8.RELEASE. When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote HTTP API, an attacker who compromises the API or tricks a user into documenting a malicious API can ...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: MEND:CVE-2026-40991...

CVE-2026-40991 XML External Entity (XXE) injection when documenting untrusted XML content

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKRESTDOCS-18322495...

HybridTestFramework - End To End Testing Of Web, API And Security

Full-fledged WEB, API and Security testing framework using selenium,ZAP OWASP proxy and rest-assured Supported Platforms This framework supports WebUi automation across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual...