CVE-2026-41000: WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41000?
The severity of CVE-2026-41000 is rated low with a score of 3.7.
What does CVE-2026-41000 affect?
CVE-2026-41000 affects the Spring Web Services software and specifically the Wss4jSecurityInterceptor.
How do I fix CVE-2026-41000?
To fix CVE-2026-41000, ensure that the correct Apache WSS4J ReplayCache instances are wired into RequestData for validation-time checks.
What is the risk associated with CVE-2026-41000?
CVE-2026-41000 has a low risk rating of 20, indicating minimal threat levels.
What vulnerabilities does CVE-2026-41000 address?
CVE-2026-41000 addresses vulnerabilities related to the ineffective protections against replay attacks on UsernameToken nonces, timestamps, and SAML one-time-use semantics.