CVE-2026-40997

EUVD-2026-36207

11.06.2026, 07:16

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 29.84%

Affected Products (NVD)

Vendor	Product	Version
broadcom	spring_web_services	𝑥 < 3.1.9
broadcom	spring_web_services	4.0.0 ≤ 𝑥 < 4.0.19
broadcom	spring_web_services	4.1.0 ≤ 𝑥 < 4.1.3.1
broadcom	spring_web_services	5.0.0 ≤ 𝑥 < 5.0.1.1

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

spring

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-209 - Generation of Error Message Containing Sensitive Information
The software generates an error message that includes sensitive information about its environment, users, or associated data.

References

https://spring.io/security/cve-2026-40997