Spring Web Services 4.0.x Release Notes

Bug Fixes

• Fixed Wss4jSecurityInterceptor to initialize inbound validation with BSP enforcement enabled, restoring the WS-I Basic Security Profile protections that were disabled by default against malformed and downgrade-attack WS-Security messages (CVE-2026-40994).
• Fixed X509AuthenticationProvider to apply Spring Security's account lifecycle checks, preventing disabled, locked, expired, or credential-expired accounts from authenticating via mutual TLS or certificate-based SOAP (CVE-2026-40995).
• Changed Wss4jSecurityInterceptor to no longer default allowRSA15KeyTransportAlgorithm to true, so inbound WS-Security decryption no longer accepts weak RSA PKCS#1 v1.5 encrypted key material unless explicitly enabled (CVE-2026-40996).
• Stopped SpringSecurityUtils.checkUserValidity from embedding full UserDetails state in thrown exception messages, closing an account-state information leak through SOAP authentication failures (CVE-2026-40997).
• Fixed Jaxp13XPathTemplate to evaluate XPath using spring-xml's hardened parsers, closing an XML External Entity (XXE) processing vulnerability on stream and SAX XPath sources (CVE-2026-40998).
• Fixed Spring WS to treat wsa:ReplyTo and wsa:FaultTo destinations as peer-supplied, preventing Server-Side Request Forgery against internal hosts and cloud metadata endpoints via outbound reply delivery (CVE-2026-40999).
• Wired Apache WSS4J ReplayCache instances into validation RequestData, so UsernameToken nonces, WS-Security timestamps, and SAML constructs are subject to replay enforcement (CVE-2026-41000).