CVE-2026-40997: SOAP security faults leak Spring Security account state
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40997?
The severity of CVE-2026-40997 is classified as medium with a score of 5.3.
What does CVE-2026-40997 exploit?
CVE-2026-40997 exploits vulnerabilities in Spring WS integration paths that can leak detailed account state information to remote SOAP clients.
How can organizations mitigate CVE-2026-40997?
Organizations can mitigate CVE-2026-40997 by ensuring that Spring Security configurations do not expose sensitive account state information in error messages.
What types of information could be leaked by CVE-2026-40997?
CVE-2026-40997 could leak sensitive information such as whether user accounts are locked or disabled through detailed exception messages.
Which software is affected by CVE-2026-40997?
CVE-2026-40997 affects applications that use Spring Web Services alongside Spring Security.