CVE-2026-40997: Spring Web Services: SOAP security faults leak Spring Security account state

June 11, 2026 (updated August 21, 2026)

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

References

github.com/advisories/GHSA-5x25-c2rf-f2jx
github.com/spring-projects/spring-ws/commit/5051fae1a836c4d7fa12dedebdca23494764e421
nvd.nist.gov/vuln/detail/CVE-2026-40997
spring.io/security/cve-2026-40997

Code Behaviors & Features

Detect and mitigate CVE-2026-40997 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →