ROOT-APP-MAVEN-CVE-2026-40994 CVE-2026-40994 in org.springframework.ws:spring-ws-security - Patched by Root

Root has patched CVE-2026-40994 in the org.springframework.ws:spring-ws-security package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40999 CVE-2026-40999 in org.springframework.ws:spring-ws-core - Patched by Root

Root has patched CVE-2026-40999 in the org.springframework.ws:spring-ws-core package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1788508031 TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.17-tuxcare.5...

CVE-2026-40997

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

This Week in Spring - January 13th, 2026

Hi, Spring fans, and welcome to another installment of This Week in Spring! It's the 13th of January, 2026, and it's been quite the week indeed! Let's dive right into it! Nobody, and I mean nobody , asked. So I put together a video on how to use Spring WS to build SOAP-based services in 2026. Hey...

XML External Entity Injection (XXE)

spring-ws is vulnerable to XML external entity injection XXE. The external document type definition external entities is not disabled by default and allows a remote attacker to perform XXE attacks via malicious XML data input...