Skip to content

Product

org.springframework.ws/spring-ws-core vulnerabilities

1 published CVE affecting org.springframework.ws/spring-ws-core, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest org.springframework.ws/spring-ws-core CVEs

Newest publication first

  1. CVE-2026-40999 Spring WS SSRF via unvalidated WS-Addressing reply destinations

    Published
    HighCVSS 8.6 EPSS 0.38%

    When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.