CVE-2026-41000: WSS4J validation does not use configured replay cache
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the Wss4jSecurityInterceptor wires the Apache WSS4J ReplayCache instance into RequestData so validation-time checks use the configured replay cache (this ensures replay protection for UsernameToken nonces, creation timestamps, Timestamp elements, and SAML one-time-use semantics).
Wss4jSecurityInterceptor ReplayCache wiring into RequestData = wired - Operational
Inventory deployments and identify any instances running the affected Spring Web Services versions: 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8. For any identified deployments, apply configuration changes to ensure ReplayCache instances are correctly wired into RequestData and plan for applying vendor fixes or patches when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41000?
The severity of CVE-2026-41000 is rated low with a score of 3.7.
What does CVE-2026-41000 affect?
CVE-2026-41000 affects the Spring Web Services software and specifically the Wss4jSecurityInterceptor.
How do I fix CVE-2026-41000?
To fix CVE-2026-41000, ensure that the correct Apache WSS4J ReplayCache instances are wired into RequestData for validation-time checks.
What is the risk associated with CVE-2026-41000?
CVE-2026-41000 has a low risk rating of 20, indicating minimal threat levels.
What vulnerabilities does CVE-2026-41000 address?
CVE-2026-41000 addresses vulnerabilities related to the ineffective protections against replay attacks on UsernameToken nonces, timestamps, and SAML one-time-use semantics.