Spring Web Services CVE-2026-40998: Brief Summary of the Jaxp13XPathTemplate XXE Bypass

Introduction

A parser-hardening bypass in Spring Web Services allows unauthenticated attackers to perform XML External Entity (XXE) attacks against any application that evaluates XPath expressions over untrusted XML using the Jaxp13XPathTemplate class. The flaw is scored at CVSS 8.2. It silently circumvents the XXE protections that Spring's own hardened parser configuration exists to enforce, so developers who assumed the framework handled XML safely were working under a false sense of security.

Spring Web Services has been caught with an XXE gap before. CVE-2019-3773 disclosed a similar class of issue seven years ago, and CVE-2013-7315 exposed XXE in the broader Spring Framework before that. Because this weakness category keeps recurring across the Spring ecosystem, CVE-2026-40998 is worth examining for its immediate impact and for what it reveals about how hard it is to keep parser hardening consistent across a large codebase.

Technical Information

Root Cause: Divergent Parser Configurations

CVE-2026-40998 is in the Jaxp13XPathTemplate class within the org.springframework.ws/spring-ws-core Maven artifact. This class implements XPathOperations using JAXP 1.3, which has been part of Java SE since version 1.5. Applications use it to evaluate XPath expressions against XML payloads, a common operation in SOAP-based web service processing.

Spring Web Services maintains a hardened XML parser configuration that disables dangerous XML features such as external entity resolution and DTD processing. However, when Jaxp13XPathTemplate processes StreamSource or SAXSource inputs, it delegates parsing to the JDK's default DocumentBuilderFactory, which does not apply Spring's hardening measures. The JDK's default behavior permits XML documents to define external entities with URIs that resolve to resources outside the application's intended sphere of control, as documented in CWE-611.

The core issue is a code-path divergence. Spring's primary XML processing paths use the hardened configuration, but Jaxp13XPathTemplate takes a separate path for these two source types, and that path skips the hardening entirely. Developers relying on Spring's documented security posture would have no indication that this particular class operates under different, weaker parsing rules.

CVSS v3.1 Scoring Breakdown

The 8.2 base score comes from easy remote exploitation combined with high confidentiality impact:

Attack Flow

The Spring advisory states the preconditions for exploitation as "exposing XPath evaluation over data controlled or influenced by remote users, either directly or through message paths, and using the vulnerable source types without an additional hardening layer."

The attack proceeds as follows:

1. The attacker locates an application endpoint that accepts XML input and processes it through Jaxp13XPathTemplate using StreamSource or SAXSource. This setup is common in SOAP-based web services that evaluate XPath on incoming messages.

2. The attacker builds an XML document containing an external entity definition. For file disclosure, the entity references a file:// URI pointing to a sensitive file on the server (e.g., /etc/passwd, application configuration files, or credentials). For SSRF, the entity references an http:// URI pointing to an internal service.

3. The attacker sends the crafted XML to the target endpoint. The attack vector is network based and requires no authentication or user interaction, so a simple HTTP request is enough.

4. The Jaxp13XPathTemplate class parses the XML using the JDK's default DocumentBuilderFactory, which does not restrict external entity resolution. The parser fetches the resource specified in the entity definition.

5. The resolved entity content (file contents or internal service responses) becomes part of the parsed document. Depending on how the application responds, this content may be returned directly to the attacker or may be extractable through error messages or out-of-band channels.

The Spring advisory names two attack outcomes: confidential file disclosure and server-side request forgery (SSRF) through external entities.

The Patch Gap Problem

Fix availability differs by version branch. OSS (open source) fixes exist only for the two most recent branches, 5.0.x and 4.1.x. Fixes for the 4.0.x and 3.1.x branches are gated behind Broadcom's Enterprise Support subscription. Organizations running these older branches without Enterprise subscriptions have no officially sanctioned remediation path.

The result is two tiers of security. Broadcom's June 2026 announcement of "day zero CVE patches" for Enterprise subscribers formalizes this model. Proofpoint has observed that adversaries increasingly exploit the gap between vulnerability disclosure and remediation. For some organizations, the lack of OSS patches for older branches extends that window indefinitely.

Affected Systems and Versions

The affected Maven package is org.springframework.ws/spring-ws-core. The following version ranges are vulnerable:

The Spring advisory notes that "versions which are no longer officially supported are also affected by this issue." Maven Central documents 227 usages of the spring-ws-core package, which indicates significant adoption in production environments.

Applications are vulnerable if they meet the following conditions:

• They use Jaxp13XPathTemplate to evaluate XPath expressions
• The XML input is provided as StreamSource or SAXSource
• The XML content is controlled or influenced by remote users, either directly or through message processing paths
• No additional XML hardening layer is applied outside of Spring's default configuration

Vendor Security History

Spring Web Services and the broader Spring Framework have a documented pattern of XXE vulnerabilities across multiple years:

The OWASP XXE Prevention Cheat Sheet notes that "some XXE vulnerabilities were found in Spring OXM and Spring MVC" affecting Spring Framework versions 3.0.0 to 3.2.3. That this weakness class keeps recurring across the Spring ecosystem suggests that hardening applied to one code path does not consistently reach every XML processing path in the codebase.

Broadcom, which now oversees the Spring portfolio through its Tanzu division, reported a 1700% increase in monthly Spring security advisories from March to April 2026. The company responded with what it described as the largest series of Spring security updates in the framework's 23-year history, including expanded security tooling and SLSA Level 3 supply-chain protections. VMware ([email protected]) assigned the CVE, a carryover of VMware's CNA role that continues under Broadcom ownership.

References

• CVE-2026-40998: Jaxp13 XPath XXE via StreamSource (Spring Advisory)
• CVE Record: CVE-2026-40998
• CVE-2026-40998 on OffSeq Radar
• CWE-611: Improper Restriction of XML External Entity Reference
• OWASP: XML External Entity (XXE) Processing
• OWASP XXE Prevention Cheat Sheet
• PortSwigger: XML External Entity (XXE) Injection
• CVE-2019-3773: XML External Entity Injection in Spring Web Services
• Spring Security Advisories (Historical)
• Broadcom Expands Its Investment in Spring and Java Ecosystem Security
• Broadcom Bolsters Spring Security with Largest Update Ever
• CISA Known Exploited Vulnerabilities Catalog
• Jaxp13XPathTemplate API Documentation
• spring-ws-core on Maven Central
• org.springframework.ws on MVN Repository
• The Patch Gap Just Got Faster and Hackers Know It (Proofpoint/PCQuest)