CVE-2026-40991

Overview

Spring REST Docs is a library for producing accurate, readable documentation for RESTful services by combining hand-written content with auto-generated snippets captured from tests written with Spring MVC Test, Spring WebFlux's WebTestClient, or REST Assured. It helps teams keep API documentation in sync with the actual behavior of their services.

A medium-severity vulnerability (CVE-2026-40991) has been identified in Spring REST Docs. The XML processors used by the spring-restdocs-webtestclient and spring-restdocs-restassured modules to document a remote API accessed over HTTP create their parsers without disabling DOCTYPE declarations or external entity resolution. An attacker who compromises the API being documented, or who tricks a user into documenting a malicious API, can return crafted XML that performs an XML External Entity (XXE) injection attack the next time the documentation-generating tests are executed, potentially disclosing local files or triggering out-of-band server-side requests from the machine running the tests.

Per OWASP, an XML External Entity (XXE) attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser, which may lead to disclosure of confidential data, denial of service, server-side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

This issue affects Spring REST Docs versions >=1.0.0 <=3.0.5, =4.0.0.

‍

Details

Module Info

• Product: Spring REST Docs
• Affected packages: spring-restdocs-core
• Affected versions: >=1.0.0 <=3.0.5, =4.0.0
• GitHub repository: https://github.com/spring-projects/spring-restdocs
• Published packages: https://central.sonatype.com/artifact/org.springframework.restdocs/spring-restdocs-core
• Package manager: Maven
• Fixed in:
• NES for Spring REST Docs
• Spring REST Docs 4.0.1, 3.0.6 (OSS)

Vulnerability Info

Spring REST Docs generates documentation snippets from the request and response payloads captured during a test. When a payload has an XML body, the spring-restdocs-core module processes it through two code paths: XmlContentHandler, which builds a DOM to extract and validate documented fields, and PrettyPrintingContentModifier, which re-parses the body with a SAX parser and re-serializes it to produce a formatted snippet.

Both paths constructed their XML parsers with default, insecure settings. XmlContentHandler created its document builder with DocumentBuilderFactory.newInstance().newDocumentBuilder(), and PrettyPrintingContentModifier created a SAXParserFactory and a Transformer the same way:

this.documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();

‍

Transformer transformer = TransformerFactory.newInstance().newTransformer();
SAXParserFactory parserFactory = SAXParserFactory.newInstance();
SAXParser parser = parserFactory.newSAXParser();

With DOCTYPE declarations permitted and external general entities resolved, an XML body such as the following causes the parser to resolve the external entity when the body is processed:

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>

Because documentation is typically generated on a developer workstation or a CI runner with access to the local filesystem and internal network, a successful XXE injection can read local files or cause out-of-band requests to internal hosts. The spring-restdocs-mockmvc flow documents locally-produced responses and is not the realistic attack surface; the exposure arises specifically when documenting a remote, attacker-influenced API with the WebTestClient or REST Assured integrations.

This vulnerability has been present since the earliest Spring REST Docs 1.x releases.

‍

Mitigation

Spring REST Docs 2.0.x and earlier are End-of-Life and do not receive free security updates; the 2.0.x line received no public fix for this issue. For End-of-Life information, see https://spring.io/projects/spring-restdocs.

Affected users should:

1. Upgrade to a supported release line that contains the fix (Spring REST Docs 3.0.6 or 4.0.1).
2. For applications that must remain on an End-of-Life line, use HeroDevs Never-Ending Support (NES) for Spring REST Docs, which provides a backported fix for this vulnerability without requiring a major upgrade. Learn more about HeroDevs Never-Ending Support for Spring REST Docs and request coverage at https://www.herodevs.com/support/spring-nes