CVE-2026-40998: Jaxp13 XPath XXE via StreamSource and SAXSource
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure Jaxp13XPathTemplate so that when evaluating XPath for StreamSource and SAXSource it uses Spring's hardened parser configuration. Ensure the underlying DocumentBuilderFactory is configured to disable external entity resolution and DTD/DOCTYPE processing to prevent XXE (i.e., use a hardened parser that does not resolve external entities or process DTDs).
Jaxp13XPathTemplate / DocumentBuilderFactory use Spring hardened parser configuration; disable external entity resolution and DTD processing = disable external entities and DTDs - Operational
Inventory your environment for Spring Web Services instances in the affected ranges: 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8. For any found, prioritize applying the hardened parser configuration (see config-change action) or other vendor-provided fixes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40998?
The severity of CVE-2026-40998 is high with a CVSS score of 8.2.
How do I fix CVE-2026-40998?
To fix CVE-2026-40998, ensure that you are using Spring's hardened parser configuration for processing XPath expressions.
What software is affected by CVE-2026-40998?
CVE-2026-40998 affects Spring Web Services.
What type of vulnerability is CVE-2026-40998?
CVE-2026-40998 is classified as an XML External Entity (XXE) vulnerability.
What does CVE-2026-40998 allow an attacker to do?
CVE-2026-40998 allows an attacker to execute XPath expressions against untrusted XML, potentially leading to data exposure.