K000163050: Spring REST Docs vulnerability CVE-2026-40991

Security Advisory Description When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the...

com.epages:restdocs-api-spec-webtestclient (>=0.20.0, <=0.20.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (4.0.0)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: - com.epages:restdocs-api-spec-webtestclient...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.epages:restdocs-api-spec-webtestclient (>=0.20.0, <=0.20.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (4.0.0)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: - com.epages:restdocs-api-spec-webtestclient...

CVE-2026-40991

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

CVE-2026-40991: Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

CVE-2026-40991 XML External Entity (XXE) injection when documenting untrusted XML content

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: MEND:CVE-2026-40991...

com.epages:restdocs-api-spec (>=0.20.0, <=0.20.2), com.epages:restdocs-api-spec-mockmvc (>=0.20.0, <=0.20.2) +11 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-core (4.0.0)

org.springframework.restdocs:spring-restdocs-core MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-core and may be impacted: - com.epages:restdocs-api-spec =0.20.0, =0.20.0, =0.20.0, =4.0....

com.epages:restdocs-api-spec-webtestclient (>=0.20.0, <=0.20.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (4.0.0)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: - com.epages:restdocs-api-spec-webtestclient...

CVE-2026-40991

The CVE-2026-40991 issue affects Spring REST Docs: 4.0.0; 3.0.0–3.0.5; and 2.0.0.RELEASE–2.0.8.RELEASE. When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote HTTP API, an attacker who compromises the API or tricks a user into documenting a malicious API can ...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKRESTDOCS-18322494...

com.epages:restdocs-api-spec-webtestclient (>=0.20.0, <=0.20.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (4.0.0)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: - com.epages:restdocs-api-spec-webtestclient...

com.epages:restdocs-api-spec (>=0.20.0, <=0.20.2), com.epages:restdocs-api-spec-mockmvc (>=0.20.0, <=0.20.2) +12 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-core (>=4.0.0-m1, <=4.0.0)

org.springframework.restdocs:spring-restdocs-core MAVEN version =4.0.0-m1, =0.20.0, =0.20.0, =0.20.0, =4.0.0-rc1, =4.0.4, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0 Source cves: CVE-2026-40991 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKRESTDOCS-17326434...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improperly configured XML parsing in the PrettyPrintingContentModifier and XmlContentHandler classes, in PrettyPrintingContentModifier.java and payload/XmlContentHandler.java. When the...