Detections
Analytics
SCA: security update for org.springframework.ws:spring-ws-security (GHSA-8qq9-r6cc-qjv9)
low Tenable Cloud Security Plugin ID 446214
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for
validation-time checks. As a result, protections against replay of UsernameToken nonces and creation
timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when
operators configured a replay cache on the interceptor. Affected versions: Spring Web Services 5.0.0
through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8. (CVE-2026-41000)
Solution
Update the org.springframework.ws:spring-ws-security library and its related packages to version 4.1.4 or later.See Also
Plugin Details
Severity: Low
ID: 446214
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/22/2026
Updated: 8/22/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-41000
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/11/2026
Vulnerability Publication Date: 6/11/2026
Reference Information
CVE: CVE-2026-41000
cwe: CWE-294