CVE-2026-40991: Spring REST Docs XXE Vulnerability

CVE-2026-40991 Overview

CVE-2026-40991 is an XML External Entity (XXE) injection vulnerability in Spring REST Docs. The flaw affects the spring-restdocs-webtestclient and spring-restdocs-restassured modules when documenting remote APIs accessed over HTTP. An attacker who compromises the documented API, or tricks a developer into pointing documentation tests at a malicious API, can inject crafted XML responses. When the documentation-generating tests next execute, the XML parser processes external entities and exposes the test environment to data disclosure and limited availability impact. The vulnerability is classified under [CWE-611] (Improper Restriction of XML External Entity Reference).

Critical Impact
Attackers can exfiltrate files from the build or test environment and trigger limited denial of service through XXE processing during automated documentation test runs.

Affected Products

Spring REST Docs 4.0.0
Spring REST Docs 3.0.0 through 3.0.5
Spring REST Docs 2.0.0.RELEASE through 2.0.8.RELEASE

Discovery Timeline

2026-06-10 - CVE-2026-40991 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-40991

Vulnerability Analysis

Spring REST Docs generates API documentation by capturing real request and response payloads during test execution. The spring-restdocs-webtestclient and spring-restdocs-restassured modules parse XML response bodies returned by the API under test. The XML parser used during this documentation phase processes external entity references without restriction. An attacker controlling the target API can return crafted XML containing external entity declarations that reference local files or remote URLs.

Root Cause

The root cause is an unsafe XML parser configuration in the documentation-generating components. The parser allows resolution of external entities and parameter entities defined in inline document type definitions (DTDs). Standard XXE hardening — disabling DOCTYPE declarations, external general entities, and external parameter entities — is not applied to the XML processing path used when capturing remote API responses.

Attack Vector

Exploitation requires that a developer execute documentation tests against an attacker-controlled or compromised HTTP API. When the malicious API returns an XML response containing an external entity declaration, the Spring REST Docs XML parser resolves the entity during test execution. The attacker can read files accessible to the test process, including source code, credentials in environment files, or build artifacts. The attacker may also force outbound HTTP requests from the test host. The combination of AV:N/AC:H/UI:R reflects that the attack requires user interaction and a non-trivial setup involving control of the documented endpoint.

No verified public proof-of-concept code is available. Refer to the Spring Security Advisory CVE-2026-40991 for vendor technical details.

Detection Methods for CVE-2026-40991

Indicators of Compromise

Unexpected outbound HTTP or DNS requests originating from CI/CD runners or developer workstations during test execution.
Test logs showing XML parsing of responses from external or untrusted HTTP endpoints.
File read access to sensitive paths such as /etc/passwd, ~/.aws/credentials, or .env files by Java test processes.

Detection Strategies

Inventory project dependencies for spring-restdocs-webtestclient and spring-restdocs-restassured at the affected versions listed above.
Audit documentation test suites for WebTestClient or RestAssured configurations that target remote, non-localhost HTTP endpoints.
Inspect captured response snippets for <!DOCTYPE, <!ENTITY, or SYSTEM declarations that indicate XXE payloads.

Monitoring Recommendations

Monitor build agents for outbound network connections to unexpected hosts during test and integrationTest phases.
Log and alert on file access patterns from JVM test processes outside the project workspace.
Track Maven and Gradle dependency manifests for the vulnerable Spring REST Docs versions across repositories.

How to Mitigate CVE-2026-40991

Immediate Actions Required

Upgrade Spring REST Docs to a fixed release as identified in the Spring Security Advisory CVE-2026-40991.
Restrict documentation tests to APIs hosted on trusted infrastructure under your control.
Run documentation test suites in isolated environments without access to production secrets or sensitive files.

Patch Information

VMware Spring published remediation guidance in the Spring Security Advisory CVE-2026-40991. Consult the advisory for the specific patched versions of Spring REST Docs 4.x, 3.x, and 2.x branches and update the corresponding Maven or Gradle dependency declarations.

Workarounds

Avoid pointing spring-restdocs-webtestclient or spring-restdocs-restassured tests at remote HTTP APIs you do not control.
Execute documentation tests inside network-segmented containers that block outbound connections and restrict filesystem access.
Strip or reject XML responses containing DOCTYPE declarations before they reach the documentation processor.

bash

# Gradle dependency override example - replace with fixed version from vendor advisory
# build.gradle
dependencies {
    testImplementation('org.springframework.restdocs:spring-restdocs-webtestclient') {
        version {
            strictly 'FIXED_VERSION'
        }
    }
    testImplementation('org.springframework.restdocs:spring-restdocs-restassured') {
        version {
            strictly 'FIXED_VERSION'
        }
    }
}