CVE-2026-40998

Katalog CVE

CVSS 8.2 · High EPSS 0,39%

Kerentanan Improper Restriction of XML External Entity Reference pada broadcom spring web services. Skor CVSS 3.1 8.2 (High) menurut vmware.com.

Deskripsi (NVD)

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber vmware.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-40998 advisory vendor