CVE-2026-40997 MEDIUM

CVE-2026-40997: SOAP security faults leak Spring Security account state

Vendor Spring
Product Spring Web Services
Weakness CWE-209 · Error message info leak
Published June 11, 2026
Last update June 11, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Key dates

02Disclosure timeline

June 11, 2026 CVE published
June 11, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-1175 birkir prime GraphQL Directive graphql information exposure CVE-2025-52611 HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability CVE-2025-65995 Apache Airflow: Disclosure of secrets to UI via kwargs CVE-2026-33192 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVE-2026-56331 Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String