CVE-2026-40998

Overview

Spring Web Services (Spring WS) is a product of the Spring community focused on creating document-driven SOAP web services, and its spring-xml module provides XML utility classes, including the XPathTemplate abstraction for evaluating XPath expressions against XML sources.

A high-severity vulnerability (CVE-2026-40998) has been identified in Spring Web Services. The Jaxp13XPathTemplate implementation evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed the supplied XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks, including confidential file disclosure or server-side request forgery through external entities, depending on parser and platform behavior.

Per OWASP, an XML External Entity (XXE) attack is an attack against an application that parses XML input containing a reference to an external entity, processed by a weakly configured XML parser; it may lead to the disclosure of confidential data, denial of service, server-side request forgery, and other system impacts. Here, the weakly configured parser is the one the JDK creates internally when an XPath expression is evaluated directly against an InputSource.

Exploitation requires that the application exposes XPath evaluation over data controlled or influenced by remote users, directly or through message paths, using the vulnerable source types without an additional hardening layer.

This issue affects >=2.4.0 <=2.4.7, >=3.1.0 <=3.1.8, >=4.0.0 <=4.0.18, >=4.1.0 <=4.1.3, and >=5.0.0 <=5.0.1 of Spring Web Services. Versions that are no longer supported are also affected.

‍

Details

Module Info

• Product: Spring Web Services
• Affected packages: spring-xml
• Affected versions: >=2.4.0 <=2.4.7, >=3.1.0 <=3.1.8, >=4.0.0 <=4.0.18, >=4.1.0 <=4.1.3, >=5.0.0 <=5.0.1
• GitHub repository: https://github.com/spring-projects/spring-ws
• Published packages: https://central.sonatype.com/artifact/org.springframework.ws/spring-xml
• Package manager: Maven
• Fixed in:
• NES for Spring Web Services 2.4.x, 3.1.x, 4.0.x
• Spring Web Services 5.0.2, 4.1.4 (OSS)

Vulnerability Info

Jaxp13XPathTemplate is the JAXP 1.3 based implementation of Spring's XPathTemplate, used to evaluate XPath expressions against any javax.xml.transform.Source. The spring-xml module ships a hardened parser configuration, DocumentBuilderFactoryUtils, which disables doctype declarations and external entity resolution so that XML from untrusted callers cannot trigger XXE processing.

However, when the source was a StreamSource, or a SAXSource whose XMLReader was discarded, Jaxp13XPathTemplate bypassed that hardened configuration entirely. Both source types were funneled into an internal callback that handed the raw InputSource directly to XPath.evaluate:

@Override
public void saxSource(XMLReader reader, InputSource inputSource) throws XPathExpressionException {
    inputSource(inputSource);
}

private void inputSource(InputSource inputSource) throws XPathExpressionException {
    this.result = this.xpath.evaluate(this.expression, inputSource, this.returnType);
}

‍
XPath.evaluate(String, InputSource, QName) instructs the JDK to parse the InputSource itself, using a default DocumentBuilderFactory with no security features applied. A payload that declares an external entity referencing a local file URI is therefore processed with external entity resolution enabled, allowing an attacker who controls the evaluated XML to read local files or to make the server issue outbound requests (server-side request forgery). In addition, the saxSource path discarded the caller's configured XMLReader, so even an application that supplied its own hardened SAX reader was silently downgraded to the unsafe default parse.

The remediation parses InputSource backed sources through the hardened DocumentBuilderFactoryUtils configuration (namespace aware) and evaluates the XPath expression against the resulting DOM document, and routes SAXSource inputs through the existing transformation path so that the caller's XMLReader is honored. With the fix in place, documents carrying a doctype with an external entity are rejected during parsing instead of being resolved. The DOMSource and StAX-based code paths were not affected.

‍

Mitigation

Spring Web Services 2.4.x, 3.1.x, and 4.0.x are End-of-Life in open source and have no publicly available fix for this issue; see https://spring.io/projects/spring-ws for the support timeline. HeroDevs does not recommend that users attempt to develop and apply their own source patches to End-of-Life software.

The recommended actions are:

1. Upgrade to a supported, fixed release. The issue is fixed in OSS in Spring Web Services 5.0.2 and 4.1.4.
2. For End-of-Life lines that cannot be upgraded, HeroDevs Never-Ending Support (NES) for Spring Web Services provides a drop-in replacement that backports this fix while remaining compatible with the affected versions. Learn more about HeroDevs Never-Ending Support for Spring.