CVE-2026-40994: Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

June 11, 2026 (updated August 21, 2026)

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

References

github.com/advisories/GHSA-gg9r-wr4p-w63h
nvd.nist.gov/vuln/detail/CVE-2026-40994
spring.io/security/cve-2026-40994

Code Behaviors & Features

Detect and mitigate CVE-2026-40994 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →