CVE-2026-40997

Katalog CVE

CVSS 5.3 · Medium EPSS 0,46%

Kerentanan Generation of Error Message Containing Sensitive Information pada broadcom spring web services. Skor CVSS 3.1 5.3 (Medium) menurut vmware.com.

Deskripsi (NVD)

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

4 September 2026

Status NVD

Undergoing Analysis

CVSS 3.1

5.3 (Medium), sumber vmware.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-40997 advisory vendor