CVE-2026-40999: Spring Web Services SSRF Vulnerability

CVE-2026-40999 Overview

CVE-2026-40999 is a Server-Side Request Forgery (SSRF) vulnerability in Spring Web Services. The flaw exists in how Spring WS processes WS-Addressing headers. When a request contains non-anonymous ReplyTo or FaultTo addresses, Spring WS initiates outbound connections through configured WebServiceMessageSender instances. The destinations are taken directly from request headers without validation. An unauthenticated remote attacker can coerce the server into connecting to arbitrary internal or external endpoints. The vulnerability is classified under [CWE-918] Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can force the Spring WS server to send requests to attacker-chosen destinations, enabling internal network reconnaissance and access to internal services not exposed to the internet.

Affected Products

Spring Web Services 5.0.0 through 5.0.1
Spring Web Services 4.1.0 through 4.1.3
Spring Web Services 4.0.0 through 4.0.18
Spring Web Services 3.1.0 through 3.1.8

Discovery Timeline

2026-06-11 - CVE-2026-40999 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-40999

Vulnerability Analysis

Spring Web Services implements WS-Addressing, a SOAP extension that allows clients to specify endpoints for asynchronous responses. The ReplyTo header indicates where the service should send a successful response. The FaultTo header indicates where the service should send fault responses. When these headers contain non-anonymous addresses, Spring WS dispatches outbound messages to the URIs they reference.

The outbound dispatch uses configured WebServiceMessageSender instances. These senders connect to the destination supplied in the SOAP envelope without applying allowlists, host validation, or scheme restrictions. An attacker submits a crafted SOAP request that points ReplyTo or FaultTo at internal services. The vulnerable server then issues HTTP or other protocol connections to those endpoints on the attacker's behalf.

Root Cause

The root cause is missing destination validation in the WS-Addressing response routing logic. Spring WS trusts the URI carried in inbound SOAP headers as the response target. The framework does not check whether the destination is in a permitted address range, uses a permitted scheme, or matches a configured allowlist of trusted endpoints.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends a SOAP request to a Spring WS endpoint that processes WS-Addressing. The attacker sets wsa:ReplyTo or wsa:FaultTo to an internal URI such as a metadata service, internal admin console, or another backend system. Spring WS then performs the outbound request from the server's network position. The scope change reflects that the server crosses a trust boundary when reaching internal resources. Detailed technical information is available in the Spring Security Advisory.

Detection Methods for CVE-2026-40999

Indicators of Compromise

Inbound SOAP requests containing wsa:ReplyTo or wsa:FaultTo elements that point to internal IP ranges, link-local addresses, or cloud metadata endpoints such as 169.254.169.254.
Outbound connections from Spring WS application servers to internal services, loopback addresses, or unexpected external hosts that correlate with inbound SOAP traffic.
Application logs showing WebServiceMessageSender activity to destinations that do not match the configured set of legitimate downstream services.

Detection Strategies

Inspect SOAP message bodies at the web application firewall or reverse proxy for WS-Addressing headers and validate the destination URIs before traffic reaches Spring WS.
Baseline normal outbound traffic from Spring WS hosts and alert on deviations, particularly connections to RFC1918 ranges, metadata IPs, or unusual ports.
Correlate inbound SOAP envelope contents with subsequent outbound connections to identify SSRF activity patterns.

Monitoring Recommendations

Enable verbose logging on the Spring WS message dispatcher and forward logs to a centralized analytics platform for correlation.
Monitor cloud workload egress for connections to instance metadata services from application servers that should never query them.
Track failure and timeout rates on outbound WebServiceMessageSender calls, as exploitation attempts often produce error patterns that differ from normal usage.

How to Mitigate CVE-2026-40999

Immediate Actions Required

Upgrade Spring Web Services to a patched release as listed in the Spring Security Advisory.
Restrict egress from Spring WS application servers using network controls so they can only reach the specific downstream endpoints required for business logic.
Disable or reject non-anonymous ReplyTo and FaultTo addresses at the application gateway if WS-Addressing asynchronous responses are not required.

Patch Information

VMware and the Spring project have published fixed versions of Spring Web Services. Administrators should upgrade beyond the affected ranges: 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, and 3.1.0 through 3.1.8. Consult the Spring Security Advisory for the exact patched version corresponding to each branch.

Workarounds

Configure a custom interceptor that rejects SOAP requests containing non-anonymous WS-Addressing ReplyTo or FaultTo URIs.
Apply strict egress firewall rules that block outbound connections from the application server to internal subnets and cloud metadata endpoints.
Place a SOAP-aware proxy or API gateway in front of Spring WS to enforce destination allowlists on WS-Addressing headers.

bash

# Example egress restriction using iptables to block metadata IP
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
# Allow only known downstream service hosts
iptables -A OUTPUT -p tcp -d trusted-backend.internal --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 80 -j REJECT
iptables -A OUTPUT -p tcp -m tcp --dport 443 -j REJECT