CVE-2026-40999Disclosure(broadcom / spring_web_services)

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch broadcom spring_web_services systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

broadcom CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://spring.io/security/cve-2026-40999

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

spring_web_services

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 3d ago at 2 mentions (2026-06-11); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

broadcom

Products

spring_web_services

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

360.0%

Patch

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-11	2	Disclosure2
2026-06-12	1	Patch1
2026-06-19	1	Patch1
2026-07-03	1	Disclosure1

Full discourse5 posts

kokumօtօ@__kokumoto136d
Patch
Spring Frameworkで深刻な脆弱性複数が修正。Spring SecurityのXSS CVE-2026-41003、Spring WSのSSRF CVE-2026-40999、XXEのCVE-2026-40998、検証バグのCVE-2026-40994。 https://securityonline.info/spring-security-vulnerabilities/
Post summary
Multiple critical CVEs in Spring Framework (XSS, SSRF, XXE, a verification bug) have been addressed with patches, as indicated by the advisory link.
01010668
7.5K followersView on X
CERT-PY@CERTpy115d
Disclosure
⚠️ Vulnerabilidades en productos Spring ❗ CVE-2026-47825 ❗ CVE-2026-41862 ❗ CVE-2026-40999 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-spring-10/ https://t.co/RzGpWIKj5P
Post summary
The post lists three new Spring product vulnerabilities (CVE‑2026‑47825, CVE‑2026‑41862, CVE‑2026‑40999) and points readers to a CERT page for additional information.
00010202
6.7K followersView on X
セキュリティ対策Lab@securityLab_jp129d
Patch
Spring SecurityとSpring WSがXSS・SSRF・XXE・BSP検証バイパスを含む複数の脆弱性を修正(CVE-2026-41003,CVE-2026-40999)他 https://rocket-boys.co.jp/security-measures-lab/spring-security-ws-cve-2026-41003-40999/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces that Spring Security and Spring WS have addressed CVE‑2026‑41003 and CVE‑2026‑40999, fixing multiple vulnerabilities including XSS, SSRF, XXE, and BSP bypass, and provides a link to the official patch details.
00000166
549 followersView on X
Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-40999 When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender ins… https://www.cve.org/CVERecord?id=CVE-2026-40999 ----- Traducción: CVE-2026-40999 Cua… http://infoflow.cloud`
Post summary
The post outlines a new Spring WS vulnerability (CVE‑2026‑40999) that allows outbound connections when non‑anonymous WS‑Addressing addresses are used, but does not provide proof of exploitation, patches, or troubleshooting steps.
0000028
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-40999 When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender ins… https://www.cve.org/CVERecord?id=CVE-2026-40999
Post summary
The text provides the initial CVE description of a Spring WS vulnerability involving non‑anonymous WS-Addressing addresses, but it does not include any PoC, exploit code, active exploitation, or patch information.
00000265
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	broadcom	spring_web_services	-	-	-

Explore more

Back to dashboard broadcom CVEs spring_web_services vulnerabilities

What researchers are saying

CVE-2026-40999

kokumօtօ[verified]@__kokumotoPatch

Multiple critical CVEs in Spring Framework (XSS, SSRF, XXE, a verification bug) have been addressed with patches, as indicated by the advisory link.

セキュリティ対策Lab[verified]@securityLab_jpPatch

The post announces that Spring Security and Spring WS have addressed CVE‑2026‑41003 and CVE‑2026‑40999, fixing multiple vulnerabilities including XSS, SSRF, XXE, and BSP bypass, and provides a link to the official patch details.

CERT-PY@CERTpyDisclosure

The post lists three new Spring product vulnerabilities (CVE‑2026‑47825, CVE‑2026‑41862, CVE‑2026‑40999) and points readers to a CERT page for additional information.

Infoflowcloud@infoflowcloudDisclosure

The post outlines a new Spring WS vulnerability (CVE‑2026‑40999) that allows outbound connections when non‑anonymous WS‑Addressing addresses are used, but does not provide proof of exploitation, patches, or troubleshooting steps.

CVE@CVEnewDisclosure

The text provides the initial CVE description of a Spring WS vulnerability involving non‑anonymous WS-Addressing addresses, but it does not include any PoC, exploit code, active exploitation, or patch information.