CVE-2026-41000— WSS4J validation does not use configured replay cache
Possible ATT&CK Techniques 1AI
T1557.002 · ARP Cache PoisoningAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Spring Web Services | 5.0.0< 5.0.1.1 | affected |
4.1.0< 4.1.3.1 | affected | ||
4.0.0< 4.0.19 | affected | ||
3.1.0< 3.1.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41000
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WSS4J validation does not use configured replay cache
Source: NVD (National Vulnerability Database)
Vulnerability Description
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: NVD (National Vulnerability Database)
Vulnerability Title
VMware Spring Web Services 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring Web Services是美国威睿（VMware）公司的一个SOAP Web服务开发框架。 VMware Spring Web Services 5.0.0至5.0.1版本、4.1.0至4.1.3版本、4.0.0至4.0.18版本和3.1.0至3.1.8版本存在安全漏洞，该漏洞源于Wss4jSecurityInterceptor未一致连接重放缓存实例，可能导致重放保护失效。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Web Services | 5.0.0 ~ 5.0.1.1 | - |
II. Public POCs for CVE-2026-41000
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41000
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-41000 (1)
Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total
| CVE-2026-40999 | 8.6 HIGH | Spring WS SSRF via unvalidated WS-Addressing reply destinations |
| CVE-2026-40998 | 8.2 HIGH | Jaxp13 XPath XXE via StreamSource and SAXSource |
| CVE-2026-40994 | 8.2 HIGH | Wss4jSecurityInterceptor disables WS-I BSP validation by default |
| CVE-2026-41699 | 8.1 HIGH | Unsafe Deserialization in Spring GraphQL |
| CVE-2026-41700 | 8.1 HIGH | Cross-Site WebSocket Hijacking in Spring for GraphQL |
| CVE-2026-41856 | 7.5 HIGH | Spring GraphQL Annotation Detection Vulnerability |
| CVE-2026-40987 | 7.1 HIGH | Remote-file synchronizer in Spring Integration writes server-supplied filename under local |
| CVE-2026-40985 | 6.4 MEDIUM | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-40995 | 5.4 MEDIUM | X.509 authentication bypasses Spring Security account checks |
| CVE-2026-41001 | 5.3 MEDIUM | Predictable Temp Directory in Artemis Auto-configuration |
| CVE-2026-40997 | 5.3 MEDIUM | SOAP security faults leak Spring Security account state |
| CVE-2026-40992 | 5.0 MEDIUM | Mail Auto-Configuration Does Not Enable SSL Hostname Verification |
| CVE-2026-40996 | 4.8 MEDIUM | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default |
| CVE-2026-40986 | 4.8 MEDIUM | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML |
IV. Related Vulnerabilities
Same product: Spring Web Services
- CVE-2026-40999
Spring WS SSRF via unvalidated WS-Addressing reply destinati - CVE-2026-40998
Jaxp13 XPath XXE via StreamSource and SAXSource - CVE-2026-40997
SOAP security faults leak Spring Security account state - CVE-2026-40996
Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by - CVE-2026-40995
X.509 authentication bypasses Spring Security account checks
Same vendor: Spring
- CVE-2026-41862
Spring Statemachine 反序列化注入漏洞 - CVE-2026-47825
Spring Cloud Gateway Server Forwards Headers from Untrusted - CVE-2026-41708
Spring Cloud Sleuth instrumentation of Spring TX DoS vulnera - CVE-2026-47835
Spring AI vector store metadata filtering to handle special - CVE-2026-41856
Spring GraphQL Annotation Detection Vulnerability
Same weakness: CWE-294
- CVE-2026-56453
HCL DFXAnalytics is affected by an Account Takeover via Resp - CVE-2026-35141
HCL DFXAnalytics is affected by a Login Replay Attack vulner - CVE-2026-35149
HCL DFXServer is affected by an Authentication Bypass vulner - CVE-2026-57574
Misskey: TOTP tokens can be reused - CVE-2026-55370
Logto: TOTP code can be replayed within the RFC 6238 validit
V. Comments for CVE-2026-41000
No comments yet