CVE-2026-41000

LowCVSS 3.7/10Last modified Sep 4, 2026

Description

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-294

Affected software

VendorProductVersions
SpringSpring Web Services>= 5.0.0, < 5.0.1.1; >= 4.1.0, < 4.1.3.1; >= 4.0.0, < 4.0.19; >= 3.1.0, < 3.1.9

References

Timeline

Published
Jun 11, 2026
Last modified
Sep 4, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-410015.3Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when noCVE-2026-410028.1The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptCVE-2026-410035.4An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring SecuritCVE-2026-410044.4When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.CVE-2026-410059.0Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the ICVE-2026-410067.5Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, peCVE-2026-410077.5Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: SCVE-2026-410086.1Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker canCVE-2026-410095.8When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_logCVE-2026-41019.8IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify IdentCVE-2026-410108.2ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where CVE-2026-410118.2PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_