CVE-2026-40998: Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Web Servicesto a version that resolves this vulnerability.Fixed in 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8Patch Jaxp13 XPath XXE via StreamSource and SAXSource - Configuration
Update the XPath evaluation code path for StreamSource and SAXSource inputs so that attacker-controlled XML is parsed using Spring’s hardened parser configuration instead of the JDK's default DocumentBuilderFactory behavior (to prevent XXE-style attacks).
Spring Web Services (Jaxp13 XPath handling for StreamSource/SAXSource) JDK DocumentBuilderFactory default vs Spring hardened parser configuration = Use Spring's hardened parser configuration (avoid JDK default DocumentBuilderFactory behavior)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40998?
The severity of CVE-2026-40998 is high with a CVSS score of 8.2.
How do I fix CVE-2026-40998?
To fix CVE-2026-40998, ensure that you are using Spring's hardened parser configuration for processing XPath expressions.
What software is affected by CVE-2026-40998?
CVE-2026-40998 affects Spring Web Services.
What type of vulnerability is CVE-2026-40998?
CVE-2026-40998 is classified as an XML External Entity (XXE) vulnerability.
What does CVE-2026-40998 allow an attacker to do?
CVE-2026-40998 allows an attacker to execute XPath expressions against untrusted XML, potentially leading to data exposure.