« Volver al listado

CVE-2026-40999

Estado: AnalizadaAlta (8.6)—

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). CWE-918 (SSRF) con cabeceras WS-Addressing permite redirigir conexiones salientes a destinos no verificados, habilitando proxying (T1090) y potencial lectura de datos internos (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (1)

Broadcom — Spring WEB Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-40999",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40999",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-11T15:06:46.401478Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Web Services",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.0.1.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "lessThan": "4.1.3.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.19",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.1.0",
              "lessThan": "3.1.9",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-11T07:16:27.907",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-40999",
      "tags": [
        "Vendor Advisory",
        "Mitigation"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8."
    },
    {
      "lang": "es",
      "value": "Cuando se utiliza WS-Addressing con direcciones ReplyTo o FaultTo no anónimas, Spring WS puede iniciar conexiones salientes a través de instancias configuradas de WebServiceMessageSender a destinos tomados directamente de los encabezados de la solicitud sin verificar que esos destinos sean seguros para conectarse.\n\nVersiones afectadas:\nSpring Web Services 5.0.0 hasta 5.0.1; 4.1.0 hasta 4.1.3; 4.0.0 hasta 4.0.18; 3.1.0 hasta 3.1.8."
    }
  ],
  "lastModified": "2026-09-04T18:18:26.267",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B633BE6-BF68-4983-9CCC-DB3D353B5E5B",
              "versionEndExcluding": "3.1.9"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78560577-BEE7-4F51-AED1-07BABD369CE9",
              "versionEndExcluding": "4.0.19",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7AB4F88-7609-466A-A799-FD19E8D07284",
              "versionEndExcluding": "4.1.3.1",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E33A13E-4CED-4B68-8E37-8ACE603F3DAC",
              "versionEndExcluding": "5.0.1.1",
              "versionStartIncluding": "5.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}