CVE-2026-40996: Spring Web Services Information Disclosure

CVE-2026-40996 Overview

CVE-2026-40996 affects Spring Web Services, where the Wss4jSecurityInterceptor component defaulted the allowRSA15KeyTransportAlgorithm flag to true. This setting overrode the safer default provided by Apache WSS4J for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag.

The weakness is classified as use of a broken or risky cryptographic algorithm [CWE-327]. RSA PKCS#1 v1.5 key transport is susceptible to Bleichenbacher-style padding oracle attacks, which can lead to recovery of encrypted session keys under repeated probing.

Critical Impact
Inbound SOAP messages signed and encrypted with the deprecated rsa-1_5 key transport algorithm are accepted by default, exposing applications to padding oracle attacks that can compromise confidentiality and integrity of WS-Security protected exchanges.

Affected Products

Spring Web Services 5.0.0 through 5.0.1
Spring Web Services 4.1.0 through 4.1.3 and 4.0.0 through 4.0.18
Spring Web Services 3.1.0 through 3.1.8

Discovery Timeline

2026-06-11 - CVE-2026-40996 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-40996

Vulnerability Analysis

The vulnerability stems from Spring Web Services overriding a security-relevant default in the underlying Apache WSS4J library. Apache WSS4J disables acceptance of rsa-1_5 key transport for validation RequestData by default. Spring's Wss4jSecurityInterceptor re-enabled it by setting allowRSA15KeyTransportAlgorithm to true.

RSA PKCS#1 v1.5 is a legacy key transport algorithm with known weaknesses. Attackers who can submit crafted SOAP messages and observe server responses can mount Bleichenbacher padding oracle attacks. Successful exploitation can leak the symmetric session key used to encrypt the message body, undermining the confidentiality guarantees of WS-Security.

The attack is network-reachable and requires no authentication or user interaction. Attack complexity is high because exploitation requires many probing requests and an observable oracle, which constrains the practical impact to confidentiality and integrity rather than full compromise.

Root Cause

The root cause is an insecure default configuration in Wss4jSecurityInterceptor. The interceptor explicitly set allowRSA15KeyTransportAlgorithm = true on the validation RequestData, overriding the safer Apache WSS4J default of false. Operators who did not manually disable the flag inherited an insecure cryptographic policy.

Attack Vector

An unauthenticated remote attacker sends crafted WS-Security SOAP requests using rsa-1_5 key transport to a vulnerable Spring Web Services endpoint. By iteratively submitting modified ciphertexts and analyzing differences in server responses or error behavior, the attacker can build a padding oracle. The oracle is then used to decrypt previously captured encrypted key material or forge valid encrypted payloads.

No verified public exploit code is available for CVE-2026-40996. Refer to the Spring Security Advisory for the authoritative technical description.

Detection Methods for CVE-2026-40996

Indicators of Compromise

Large volumes of inbound SOAP requests containing <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> references in the WS-Security header.
Repeated WS-Security decryption failures from a single source IP, consistent with padding oracle probing.
Unusual spikes in 500-class responses or WSS4J FAILED_CHECK errors against SOAP endpoints.

Detection Strategies

Inspect WS-Security headers at the application gateway or WAF for the rsa-1_5 key transport algorithm identifier and alert or block on its presence.
Audit Spring Web Services configurations to identify Wss4jSecurityInterceptor beans where allowRSA15KeyTransportAlgorithm has not been explicitly set to false.
Correlate authentication, decryption, and signature validation error rates per source to surface oracle-style probing patterns.

Monitoring Recommendations

Enable verbose WSS4J logging in pre-production and capture the negotiated key transport algorithm per request for audit.
Forward application and gateway logs to a centralized analytics platform and alert on sustained WS-Security failure thresholds.
Track outbound dependency versions of spring-ws-security and wss4j to detect drift from patched releases.

How to Mitigate CVE-2026-40996

Immediate Actions Required

Upgrade Spring Web Services to a patched release identified in the Spring Security Advisory.
Explicitly set allowRSA15KeyTransportAlgorithm to false on every Wss4jSecurityInterceptor validation configuration until upgrades complete.
Reject inbound SOAP messages that declare rsa-1_5 key transport at the gateway, allowing only rsa-oaep or rsa-oaep-mgf1p.

Patch Information

VMware Tanzu/Spring has published fixed versions of Spring Web Services that restore the safer Apache WSS4J default. Affected branches are 5.0.x (≤ 5.0.1), 4.1.x (≤ 4.1.3), 4.0.x (≤ 4.0.18), and 3.1.x (≤ 3.1.8). Consult the Spring Security Advisory for exact patched build numbers and upgrade guidance.

Workarounds

Override the interceptor configuration in application code or XML to disable rsa-1_5 acceptance for validation RequestData.
Enforce an allow-list of acceptable XML Encryption algorithms in upstream API gateways or service mesh policies.
Where feasible, require mutual TLS and authenticated clients to reduce exposure to unauthenticated padding oracle probing.

bash

# Configuration example: disable RSA 1.5 key transport in Wss4jSecurityInterceptor
# Java configuration
# Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
# interceptor.setAllowRSA15KeyTransportAlgorithm(false);

# XML configuration
# <bean class="org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor">
#   <property name="allowRSA15KeyTransportAlgorithm" value="false"/>
# </bean>