Loading vulnerability…
Spring Web Services RSA PKCS#1 v1.5 Key Transport Enabled by Default
CVE-2026-40996 is a cryptographic-default vulnerability in Spring Web Services' Wss4jSecurityInterceptor. The interceptor set the inbound validation setting allowing RSA PKCS#1 v1.5 key transport to true, overriding Apache WSS4J's safer default. Consequently, inbound WS-Security decryption accepted rsa-1_5 encrypted key material unless administrators explicitly disabled the option. Affected versions are Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerable default permits use of the legacy RSA PKCS#1 v1.5 key-transport construction for inbound WS-Security messages. This weakens cryptographic protections and can expose affected services to practical attacks on rsa-1_5 where an attacker can establish the necessary man-in-the-middle or cryptographic-oracle conditions. Reported CVSS v3.1 impact is limited confidentiality and integrity impact, with no availability impact.
If you can’t patch tonight, do this now.
Explicitly configure Wss4jSecurityInterceptor to disable RSA PKCS#1 v1.5 key transport by setting allowRSA15KeyTransportAlgorithm to false. This prevents inbound validation and decryption from accepting rsa-1_5 key transport while an upgrade is pending.
Patch, then assume compromise.
Upgrade Spring Web Services to 5.0.2 or later on the 5.0.x branch, or 4.1.4 or later on the 4.1.x branch. Enterprise Support fixes are available as 4.0.19 for the 4.0.x branch and 3.1.9 for the 3.1.x branch. Deployments on unsupported branches without access to those fixes should migrate to a supported fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.