GHSA-5x25-c2rf-f2jx

Source

https://github.com/advisories/GHSA-5x25-c2rf-f2jx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5x25-c2rf-f2jx/GHSA-5x25-c2rf-f2jx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5x25-c2rf-f2jx

Aliases

CVE-2026-40997

Published

2026-06-11T09:31:56Z

Modified

2026-08-21T19:25:58Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Spring Web Services: SOAP security faults leak Spring Security account state

Details

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Database specific

{
    "cwe_ids":  [
        "CWE-209"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-21T19:13:01Z",
    "nvd_published_at":  "2026-06-11T07:16:27Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.springframework.ws:spring-ws-security

Package

Name: org.springframework.ws:spring-ws-security; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.ws/spring-ws-security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.2

Affected versions

5.*

5.0.0

5.0.1

Database specific

last_known_affected_version_range

"<= 5.0.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5x25-c2rf-f2jx/GHSA-5x25-c2rf-f2jx.json"

org.springframework.ws:spring-ws-security

Package

Name: org.springframework.ws:spring-ws-security; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.ws/spring-ws-security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Fixed

4.1.4

Affected versions

4.*

4.1.0

4.1.1

4.1.2

4.1.3

Database specific

last_known_affected_version_range

"<= 4.1.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5x25-c2rf-f2jx/GHSA-5x25-c2rf-f2jx.json"

org.springframework.ws:spring-ws-security

Package

Name: org.springframework.ws:spring-ws-security; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.ws/spring-ws-security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Last Affected

4.0.18

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0.10

4.0.11

4.0.12

4.0.13

4.0.14

4.0.15

4.0.16

4.0.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5x25-c2rf-f2jx/GHSA-5x25-c2rf-f2jx.json"

org.springframework.ws:spring-ws-security

Package

Name: org.springframework.ws:spring-ws-security; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.ws/spring-ws-security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.0

Last Affected

3.1.8

Affected versions

3.*

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5x25-c2rf-f2jx/GHSA-5x25-c2rf-f2jx.json"