CVE-2026-40998Disclosure(broadcom / spring_web_services)

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

broadcom CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://spring.io/security/cve-2026-40998

Weakness type (CWE)

CWE-611

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

spring_web_services

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-06-11); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

broadcom

Products

spring_web_services

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-11	2	Disclosure1General1
2026-06-12	1	Disclosure1
2026-06-13	1	Disclosure1

Full discourse4 posts

CVE@CVEnew137d
General
CVE-2026-40998 Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default Doc… https://www.cve.org/CVERecord?id=CVE-2026-40998
Post summary
The post references CVE-2026-40998 and provides a brief technical description of an XPath evaluation issue in the JDK, but does not mention any exploits, patches, or real‑world usage.
00010364
57.6K followersView on X
cybersecuritypath@cybrsecpath135d
Disclosure
CVE-2026-40998: Critical Spring Web Services XXE Vulnerability https://thecybrdef.com/cve-2026-40998-critical-spring-web-services-xxe-vulnerability/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
A new critical XXE vulnerability (CVE-2026-40998) in Spring Web Services has been announced, but no PoC, exploit code, active exploitation, or patch details are mentioned.
0000029
9 followersView on X
Crypto Master💎 Arichain@Vijaykiran0987136d
Disclosure
CVE-2026-40998: Critical Spring Web Services XXE Vulnerability https://thecybrdef.com/cve-2026-40998-critical-spring-web-services-xxe-vulnerability/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post announces CVE-2026-40998, a critical Spring Web Services XXE vulnerability, with a reference link for more information but no PoC, exploit, or mitigation details.
0000030
64 followersView on X
Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-40998 Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default Doc… https://www.cve.org/CVERecord?id=CVE-2026-40998 ----- Traducción: CVE-2026-40998 Jax… http://infoflow.cloud`
Post summary
The text reports the disclosure of CVE‑2026‑40998, describing its technical details involving JAXP XPath evaluation on attacker‑controlled XML.
0000031
79 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	broadcom	spring_web_services	-	-	-

Explore more

Back to dashboard broadcom CVEs spring_web_services vulnerabilities

What researchers are saying

CVE-2026-40998

CVE@CVEnewGeneral

The post references CVE-2026-40998 and provides a brief technical description of an XPath evaluation issue in the JDK, but does not mention any exploits, patches, or real‑world usage.

cybersecuritypath@cybrsecpathDisclosure

A new critical XXE vulnerability (CVE-2026-40998) in Spring Web Services has been announced, but no PoC, exploit code, active exploitation, or patch details are mentioned.

Crypto Master💎 Arichain@Vijaykiran0987Disclosure

The post announces CVE-2026-40998, a critical Spring Web Services XXE vulnerability, with a reference link for more information but no PoC, exploit, or mitigation details.

Infoflowcloud@infoflowcloudDisclosure

The text reports the disclosure of CVE‑2026‑40998, describing its technical details involving JAXP XPath evaluation on attacker‑controlled XML.