CVE-2026-40996

Katalog CVE

CVSS 4.8 · Medium EPSS 0,15%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada broadcom spring web services. Skor CVSS 3.1 4.8 (Medium) menurut vmware.com.

Deskripsi (NVD)

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber vmware.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-40996 advisory vendor · mitigasi