org.springframework.ws/spring-xml vulnerabilities

Latest org.springframework.ws/spring-xml CVEs

Newest publication first

1. CVE-2026-40998 Jaxp13 XPath XXE via StreamSource and SAXSource

   Published 2026-06-11

   High·CVSS 8.2 EPSS 0.35%

   Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath a...

2. CVE-2019-3773 Spring Web Services XML External Entity Injection (XXE)

   Published 2019-01-18

   Critical·CVSS 9.8 EPSS 4.1%

   Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.