|
ELS
< Back

CVE-2026-40999

Updated on 11 Jun 2026

Severity

8.6 High severity

Details

CVSS score
8.6
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. A remote attacker may supply crafted addressing headers that cause the server to connect to internal-only hosts, cloud metadata endpoints, or other sensitive destinations (SSRF).

This issue only affects deployments where all the following are true:

  • An AbstractAddressingEndpointMapping subclass is registered with one or more WebServiceMessageSender instances configured for out-of-band replies.
  • The service accepts WS-Addressing headers (wsa:ReplyTo / wsa:FaultTo) from untrusted callers.
  • No restrictive destination validator or equivalent network-level egress control is in place.

Details

Affected product:
Spring , camel
Affected packages:
Spring Boot @ 3.3.12 (+2851 more)

Fixes