CVE-2026-40999: Spring WS SSRF via unvalidated WS-Addressing reply destinations
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable handling of non-anonymous WS-Addressing ReplyTo and FaultTo addresses (reject requests with non-anonymous ReplyTo/FaultTo or require anonymous addresses only) to prevent the server from initiating outbound connections to attacker-controlled destinations.
Spring Web Services (WS-Addressing) allow non-anonymous ReplyTo/FaultTo = disabled - Configuration
Enable validation/whitelisting of WS-Addressing ReplyTo and FaultTo destination addresses in incoming messages and only permit outbound connections to explicitly approved destinations; reject or ignore requests with destinations that are not validated.
Spring Web Services (WebServiceMessageSender) validate ReplyTo/FaultTo destinations = enabled (whitelist)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40999?
CVE-2026-40999 has a severity score of 8.6, categorizing it as high risk.
How do I fix CVE-2026-40999?
To fix CVE-2026-40999, ensure to validate WS-Addressing reply destinations to prevent unintended outbound connections.
What types of applications are affected by CVE-2026-40999?
CVE-2026-40999 affects applications using Spring Web Services with unvalidated WS-Addressing reply addresses.
What is the risk associated with CVE-2026-40999?
The risk associated with CVE-2026-40999 involves potential SSRF attacks that can lead to unauthorized access to internal services.
When was CVE-2026-40999 published?
CVE-2026-40999 was published on June 11, 2026.