Spring Web Services CVE-2026-40999: Brief Summary of a High Severity SSRF via WS-Addressing Headers

Introduction

A newly disclosed SSRF vulnerability in Spring Web Services lets unauthenticated attackers weaponize WS-Addressing headers and turn a SOAP endpoint into an open proxy. Through it, they can reach internal networks, cloud metadata services, and other infrastructure that should never be accessible from outside. CVE-2026-40999 is scored at CVSS 8.6 with a "Changed" scope designation and affects four major version branches of Spring WS. It was patched on June 10, 2026, as part of what Broadcom calls the largest Spring security update in the framework's 23-year history.

Technical Information

Root Cause: Unvalidated WS-Addressing Destinations

The vulnerability is in AbstractAddressingEndpointMapping, the class that processes WS-Addressing headers in Spring Web Services. WS-Addressing is a W3C specification that provides a transport-neutral mechanism for addressing web services and their messages. It lets SOAP clients say where responses (wsa:ReplyTo) and fault messages (wsa:FaultTo) should be delivered, instead of relying on the underlying transport protocol's reply channel.

The problem is simple. AbstractAddressingEndpointMapping accepted destination URIs straight from incoming SOAP request headers and sent outbound connections to them through the configured WebServiceMessageSender instances, with no validation whatsoever. There was no allow list, no deny list, no scheme restriction, and no policy check of any kind. Whatever URI an attacker placed in the wsa:ReplyTo or wsa:FaultTo header, the server would dutifully connect to it.

This is a textbook case of CWE-918 (Server-Side Request Forgery), which MITRE defines as a weakness where "a web server accepts a URL from a user or upstream component and retrieves its contents without validating whether the request is going to the intended destination." SSRF appears in the OWASP Top 10 as a critical web application security risk.

CVSS v3.1 Vector Analysis

The full CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, which gives a score of 8.6 (High).

Component	Value	Meaning
Attack Vector (AV)	Network	Exploitable remotely over the network
Attack Complexity (AC)	Low	No special conditions required beyond the prerequisites
Privileges Required (PR)	None	No authentication needed
User Interaction (UI)	None	No user action required
Scope (S)	Changed	Impact extends beyond the vulnerable component
Confidentiality (C)	High	Complete information disclosure possible
Integrity (I)	None	No direct integrity impact
Availability (A)	None	No direct availability impact

The Changed scope is what sets this score apart. It means the vulnerable component (Spring WS) can affect resources beyond its own security authority. The Spring WS server sits in a trusted network position, so it can reach internal services, databases, and cloud metadata endpoints that the external attacker has no direct access to. The High confidentiality rating reflects that an attacker can read data from these internal services, including IAM credentials from cloud metadata endpoints like http://169.254.169.254/latest/meta-data/.

Exploitation Prerequisites

The Spring advisory says exploitation requires three conditions to converge:

An AbstractAddressingEndpointMapping subclass must be registered for out-of-band replies via WS-Addressing. This is not enabled by default in all Spring WS deployments.
WS-Addressing headers must be accepted from untrusted callers. If all SOAP clients are internal and trusted, the risk is reduced, though not eliminated, because a compromised internal client could still exploit the flaw.
There must be no active destination validator or egress control. Deployments without network-level egress filtering or application-level destination validation are fully exposed.

These conditions are not exotic. Any internet-facing SOAP service that implements WS-Addressing for asynchronous response patterns and lacks egress controls meets all three.

Attack Flow

An attacker exploiting CVE-2026-40999 would follow this sequence:

Identify a target Spring WS endpoint that accepts SOAP requests with WS-Addressing headers. The attacker can find one by inspecting the WSDL or by sending test requests with wsa:ReplyTo headers and watching how the server behaves.
Craft a SOAP request with a wsa:ReplyTo or wsa:FaultTo header that holds a malicious destination URI. For cloud credential theft, this would be something like http://169.254.169.254/latest/meta-data/iam/security-credentials/. For internal network scanning, the attacker would iterate through internal IP ranges and ports.
Send the crafted request to the vulnerable endpoint. No authentication is required.
The Spring WS server processes the request, generates a response (or fault), and opens an outbound connection to the attacker-specified URI through its configured WebServiceMessageSender.
The attacker observes the results. If the wsa:ReplyTo points to an attacker-controlled server, the attacker receives the SOAP response payload directly. If the destination is an internal service, the attacker can infer information from response timing or error messages, or by chaining the SSRF with other techniques.

With this attack, an attacker can:

map the internal network through response timing and error analysis
retrieve cloud metadata, including IAM credentials and API keys
exfiltrate sensitive SOAP response payloads to attacker-controlled infrastructure
interact with internal management interfaces that are not exposed to the internet

Patch Information

On June 10, 2026, the Spring team released Spring Web Services 5.0.2 and 4.1.4 to fix CVE-2026-40999. Both releases are publicly available on Maven Central and were announced on the official Spring blog.

What the Fix Changes

The fix adds a new DestinationPolicy mechanism for WS-Addressing out-of-band destinations. It is tracked under GitHub issue #1836 (for the 4.1.x branch, milestone 4.1.4) and #1843 (forward-ported to the 5.0.x branch, milestone 5.0.2). Spring team member snicoll created and closed both issues, and #1843 is explicitly noted as a "forward port of issue #1836 to 5.0.x." Both were closed on June 10, 2026.

The DestinationPolicy acts as a gate. Before Spring WS sends any out-of-band reply or fault to a URI taken from WS-Addressing headers, it now checks this policy to decide whether the destination is safe to connect to. The server will no longer blindly relay responses to arbitrary endpoints.

Version Matrix

Affected Versions	Fix Version	Availability
5.0.0 to 5.0.1	5.0.2	OSS (public)
	5.0.1.1	Enterprise Support Only
4.1.0 to 4.1.3	4.1.4	OSS (public)
	4.1.3.1	Enterprise Support Only
4.0.0 to 4.0.18	4.0.19	Enterprise Support Only
3.1.0 to 3.1.8	3.1.9	Enterprise Support Only

Versions 4.0.x and 3.1.x are considered end of life for open source support. Their fixes are available only through Spring's commercial enterprise support program, via Broadcom's Tanzu division. Organizations on these older branches must either upgrade to a supported OSS branch (4.1.x or 5.0.x) or keep an enterprise support contract.

Workaround for Deferred Upgrades

For users who cannot upgrade right away, the Spring advisory describes a workaround: override the supports method on each configured WebServiceMessageSender so it allowlists safe destination URIs. The advisory includes a concrete Java example that subclasses JmsMessageSender and gates its supports() on a custom isAllowedDestination() check. It recommends the same pattern for HttpUrlConnectionMessageSender, MailMessageSender, and any other sender types in use. This matches the OWASP SSRF Prevention Cheat Sheet's recommendation that explicitly enumerating permitted destinations is more reliable than trying to block known bad ones.

Defense in Depth

Beyond patching, organizations should consider these layered defenses:

Filter egress at the network level. Allow the Spring WS application server to make outbound connections only to known, required destinations, so the SSRF cannot reach internal hosts or cloud metadata endpoints even if application-level validation is bypassed.
Block cloud provider metadata IP addresses (169.254.169.254) at the network level on application servers that have no legitimate need to reach them.
Require authentication on internal services that the Spring WS server can reach. This limits what an SSRF can accomplish even if a connection is made.
Where WS-Addressing is required, accept non-anonymous ReplyTo/FaultTo headers only from authenticated and authorized callers.

Affected Systems and Versions

CVE-2026-40999 affects the following Spring Web Services version ranges:

Spring Web Services 5.0.0 through 5.0.1 (5.0.x branch)
Spring Web Services 4.1.0 through 4.1.3 (4.1.x branch)
Spring Web Services 4.0.0 through 4.0.18 (4.0.x branch, end of life)
Spring Web Services 3.1.0 through 3.1.8 (3.1.x branch, end of life)

Older unsupported branches prior to 3.1.x are also likely affected, but they have not received patches or a formal assessment.

The vulnerability is triggered when these configuration conditions are met:

An AbstractAddressingEndpointMapping subclass is registered for out-of-band replies via WS-Addressing.
WS-Addressing headers are accepted from untrusted callers.
No destination validator or egress control is active.

Organizations should audit every Spring WS deployment on every version branch. The vulnerability is not limited to the latest branch, and older deployments on 4.0.x or 3.1.x may be particularly at risk because no freely available patches exist for them.

Vendor Security History

The Spring ecosystem has seen a notable volume of security activity in 2026. CVE-2026-40999 was patched alongside six other CVEs (CVE-2026-40994 through CVE-2026-41000) in the Spring WS 5.0.2 and 4.1.4 releases. They cover several vulnerability types, including:

CVE-2026-40994: Disabled BSP enforcement
CVE-2026-40995: X509AuthenticationProvider bypass
CVE-2026-40998: XXE via unhardened XPath
CVE-2026-41000: UsernameToken replay issues

Beyond Spring WS, the broader Spring portfolio has seen CVE-2026-22732 (Spring Security caching issues), CVE-2026-41842 (Spring Framework DoS via static resource resolution), CVE-2026-22739 (Spring Cloud Config SSRF), and CVE-2026-45609 (Spring AI MCP Security SSRF).

SSRF keeps recurring across different Spring projects. The Spring Cloud Config, Spring AI MCP, and now Spring WS cases share the same structure. A protocol-level feature lets the requester specify a destination, and the framework processes that destination without safety checks. Organizations using Spring should audit other components that handle externally influenced connection targets.

Broadcom's Tanzu division has responded with what it describes as the largest Spring security update in the framework's 23-year history, including day-zero CVE patches and SLSA Level 3 supply-chain security for the Java ecosystem.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information