{"cve":"CVE-2026-40997","nvd":{"published":"2026-06-11T07:16:27.663","modified":"2026-09-04T17:01:57.973","status":"Undergoing Analysis","description":"Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-209"],"references":["https://spring.io/security/cve-2026-40997"],"products":["broadcom:spring_web_services"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-40997","score":0.00366,"percentile":0.30421,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5x25-c2rf-f2jx","url":"https://osv.dev/vulnerability/GHSA-5x25-c2rf-f2jx","summary":"Spring Web Services: SOAP security faults leak Spring Security account state","modified":"2026-08-21T19:25:58.871894Z","packages":[{"ecosystem":"Maven","name":"org.springframework.ws:spring-ws-security","purl":"pkg:maven/org.springframework.ws/spring-ws-security","ranges":[">=5.0.0 <5.0.2"],"fixed":["5.0.2"]},{"ecosystem":"Maven","name":"org.springframework.ws:spring-ws-security","purl":"pkg:maven/org.springframework.ws/spring-ws-security","ranges":[">=4.1.0 <4.1.4"],"fixed":["4.1.4"]},{"ecosystem":"Maven","name":"org.springframework.ws:spring-ws-security","purl":"pkg:maven/org.springframework.ws/spring-ws-security","ranges":[">=4.0.0 <=4.0.18"],"fixed":[]},{"ecosystem":"Maven","name":"org.springframework.ws:spring-ws-security","purl":"pkg:maven/org.springframework.ws/spring-ws-security","ranges":[">=3.1.0 <=3.1.8"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}