CVE-2026-40999: Spring WS SSRF via unvalidated WS-Addressing reply destinations
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40999?
CVE-2026-40999 has a severity score of 8.6, categorizing it as high risk.
How do I fix CVE-2026-40999?
To fix CVE-2026-40999, ensure to validate WS-Addressing reply destinations to prevent unintended outbound connections.
What types of applications are affected by CVE-2026-40999?
CVE-2026-40999 affects applications using Spring Web Services with unvalidated WS-Addressing reply addresses.
What is the risk associated with CVE-2026-40999?
The risk associated with CVE-2026-40999 involves potential SSRF attacks that can lead to unauthorized access to internal services.
When was CVE-2026-40999 published?
CVE-2026-40999 was published on June 11, 2026.