CVE-2026-40994
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Spring Web Services (Spring WS) is a product of the Spring community focused on creating document-driven, contract-first SOAP web services. Its spring-ws-security module integrates Apache WSS4J so that applications can sign, encrypt, and validate SOAP messages according to the WS-Security standard, with Wss4jSecurityInterceptor acting as the central interceptor for securing outgoing messages and validating incoming ones.
A high-severity vulnerability (CVE-2026-40994) has been identified in Spring Web Services. The Wss4jSecurityInterceptor initialized its WS-I Basic Security Profile (BSP) compliance flag to false, so inbound validation always disabled WSS4J's BSP enforcement, contradicting both the documented default of the setBspCompliant setter and WSS4J's own secure default. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules around signatures and related constructs, weakening protocol-level checks that are meant to constrain interoperable, safe use of WS-Security.
Per OWASP, this class of weakness falls under cryptographic failures, which cover failures related to cryptography such as improper verification of cryptographic signatures, and which often lead to exposure of sensitive data or system compromise. The WS-I Basic Security Profile exists precisely to rule out ambiguous and abuse-prone WS-Security constructs, such as non-standard signature transforms, and disabling its enforcement allows messages using those constructs to pass validation.
This issue affects versions >=2.4.0 <=2.4.7, >=3.1.0 <=3.1.8, >=4.0.0 <=4.0.18, >=4.1.0 <=4.1.3, >=5.0.0 <=5.0.1 of Spring Web Services.
Details
Module Info
- Product: Spring Web Services
- Affected packages: spring-ws-security
- Affected versions: >=2.4.0 <=2.4.7, >=3.1.0 <=3.1.8, >=4.0.0 <=4.0.18, >=4.1.0 <=4.1.3, >=5.0.0 <=5.0.1
- GitHub repository: https://github.com/spring-projects/spring-ws
- Published packages: https://central.sonatype.com/artifact/org.springframework.ws/spring-ws-security
- Package manager: Maven
- Fixed in:
- NES for Spring Web Services 2.4.x, 3.1.x, 4.0.x
- Spring Web Services 5.0.2, 4.1.4 (OSS)
Vulnerability Info
Wss4jSecurityInterceptor exposes a setBspCompliant(boolean) property whose Javadoc documents the default as true, matching Apache WSS4J's secure default of enforcing the WS-I Basic Security Profile during validation. The backing field, however, was declared without an initializer and therefore defaulted to false:
private boolean bspCompliant;When the interceptor prepares the WSS4J RequestData for inbound validation, it propagates the inverse of that flag:
requestData.setDisableBSPEnforcement(!this.bspCompliant);
if (requestData.getBSPEnforcer() != null) {
requestData.getBSPEnforcer().setDisableBSPRules(!this.bspCompliant);
}
With bspCompliant defaulting to false, every inbound validation ran with setDisableBSPEnforcement(true), silently turning off WSS4J's Basic Security Profile checks unless the application explicitly called setBspCompliant(true). The BSP rules constrain how WS-Security elements such as signatures, transforms, and references may be expressed, and WSS4J relies on them to reject ambiguous or known-dangerous constructs. With enforcement disabled, an attacker who can send SOAP messages to a service that uses Wss4jSecurityInterceptor for inbound validation can craft messages that deviate from the profile, for example by using non-standard transforms or unusual signature structures, and have them accepted by checks that were expected to reject them. This primarily undermines the integrity guarantees that WS-Security validation is supposed to provide.
The remediation initializes the flag to true so that BSP enforcement is on by default, aligning the actual behavior with the published setter contract and with WSS4J. Applications that must interoperate with peers that intentionally deviate from BSP rules can still opt out explicitly by calling setBspCompliant(false).
Mitigation
Spring Web Services 4.0.x, 3.1.x, and all older lines, including 2.4.x, are End-of-Life for open source users and have no publicly available fix for this issue. For support timeline information, see https://spring.io/projects/spring-ws.
Affected users should:
- Upgrade to a supported release line that contains the fix (Spring Web Services 5.0.2 or 4.1.4).
- For applications that must remain on an End-of-Life line, use HeroDevs Never-Ending Support (NES) for Spring Web Services, which provides a backported fix for this vulnerability without requiring a major upgrade. Learn more about HeroDevs Never-Ending Support for Spring Web Services and request coverage at https://www.herodevs.com/support/spring-nes.
As an interim hardening measure on any version, explicitly call setBspCompliant(true) on every Wss4jSecurityInterceptor used for inbound validation. Note that after applying the fix or enabling BSP compliance, messages from peers that violate the WS-I Basic Security Profile will be rejected; peers should be brought into compliance rather than disabling enforcement.
