PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40997 Spring CVE debrief

CVE-2026-40997 is a medium-severity vulnerability in Spring Web Services that could allow remote attackers to infer account state through exception messages or callback outcomes. The vulnerability affects several Spring WS integration paths with Spring Security, potentially surfacing detailed account state, such as locked or disabled user semantics, to remote SOAP clients.

Vendor
Spring
Product
Spring Web Services
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-09-04
Advisory published
2026-06-11
Advisory updated
2026-09-04

Who should care

Users of affected Spring Web Services versions (5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8) should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability is caused by the detailed exception messages or callback outcomes in Spring WS integration paths with Spring Security. This could assist remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to a non-vulnerable version of Spring Web Services.
  • Implement generic authentication error handling to prevent detailed account state disclosure.

Evidence notes

The CVE-2026-40997 vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The affected versions of Spring Web Services are 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40997 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40997

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40997 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40997

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.