Loading vulnerability…
Spring Web Services Wss4jSecurityInterceptor BSP Enforcement Disabled by Default
CVE-2026-40994 is an insecure-default vulnerability in Spring Web Services Wss4jSecurityInterceptor. The interceptor initializes its WS-I Basic Security Profile (BSP) compliance setting such that inbound WSS4J RequestData validation does not enforce BSP rules, overriding the secure default of the underlying WSS4J library. Consequently, WS-Security-protected SOAP services can accept inbound messages that violate BSP requirements, including rules governing signatures and related security constructs. Affected versions are Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote unauthenticated attackers may submit WS-Security messages that do not conform to BSP requirements but are nevertheless accepted by affected inbound validation. This weakens protocol-level WS-Security controls and can compromise the integrity of SOAP message validation. The reported CVSS vector indicates low confidentiality impact, high integrity impact, and no direct availability impact.
If you can’t patch tonight, do this now.
Where an immediate upgrade is not possible, explicitly enable BSP enforcement on each affected Wss4jSecurityInterceptor by calling setBspCompliant(true). Validate that all inbound WS-Security processing paths use the hardened interceptor configuration and reject messages failing BSP conformance.
Patch, then assume compromise.
Upgrade Spring Web Services to a fixed release. Public fixes are Spring Web Services 5.0.2 for the 5.0.x branch and 4.1.4 for the 4.1.x branch. Enterprise-support fixes are available as 5.0.1.1, 4.1.3.1, 4.0.19, and 3.1.9 for their respective maintenance branches. Deployments on unsupported 4.0.x or 3.1.x releases should migrate to a supported fixed branch if enterprise fixes are unavailable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.