org.springframework.restdocs vulnerabilities

Products

• org.springframework.restdocs/spring-restdocs-restassured 1
• org.springframework.restdocs/spring-restdocs-webtestclient 1

Latest org.springframework.restdocs CVEs

Newest publication first

1. CVE-2026-40991 XML External Entity (XXE) injection when documenting untrusted XML content

   Published 2026-06-09

   Medium·CVSS 5.9

   When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.