Spring for GraphQL: Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +78 more potentially affected by CVE-2026-40999 via org.springframework.ws:spring-ws-core (>=4.0.0, <=4.0.17)

org.springframework.ws:spring-ws-core MAVEN version =4.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-40999 Source advisory: GHSA-WHPP-XV3H-RWXF...

Spring for GraphQL: Unsafe Deserialization

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and the classpath contains specifi...

GHSA-PHXQ-526M-79PX Spring for GraphQL: Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

GHSA-2MPF-M756-HXJM Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-41000 Source advisory: OSV:GHSA-8QQ9-R6CC-QJV9...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40994 Source advisory: OSV:GHSA-GG9R-WR4P-W63H...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-41000 Source advisory: OSV:GHSA-8QQ9-R6CC-QJV9...

GHSA-6MFM-98WV-32WM Spring Web Services: X.509 authentication bypasses Spring Security account checks

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts. Affected versions: Spring Web...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40997 Source advisory: GHSA-5X25-C2RF-F2JX...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-41000 Source advisory: GHSA-8QQ9-R6CC-QJV9...

cn.openapis:hy.microservice (>=1.21.9, <=1.22.8), com.github.salilvnair:api-processor (1.0.6) +29 more potentially affected by CVE-2026-40999 via org.springframework.ws:spring-ws-core (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-core MAVEN version =5.0.0, =1.21.9, =2.0.8, =8.9.0-alpha3, =1.0.0, =5.0.0-beta.1, =1.4.66, =4.19.0, =4.19.0, =8.0.0-rc1, =8.0.0-rc5 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 -...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40994 Source advisory: OSV:GHSA-GG9R-WR4P-W63H...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40996 Source advisory: GHSA-P7QJ-2Q5W-F9R7...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40997 Source advisory: OSV:GHSA-5X25-C2RF-F2JX...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +73 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-xml MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40998 Source advisory: OSV:GHSA-2MPF-M756-HXJM...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40995 Source advisory: OSV:GHSA-6MFM-98WV-32WM...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41856 Source advisory: OSV...

GHSA-5X25-C2RF-F2JX Spring Web Services: SOAP security faults leak Spring Security account state

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40997 Source advisory: GHSA-5X25-C2RF-F2JX...