Detections
Analytics

SCA: security update for org.springframework.ws:spring-ws-security (GHSA-5x25-c2rf-f2jx)

medium Tenable Self-Hosted Container Security Plugin ID 446240

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Several Spring WS integration paths with Spring Security could surface detailed account state (for example
 locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes,
 instead of failing with generic authentication errors. That behavior assists remote attackers in
 distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring
 Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
 (CVE-2026-40997)

Solution

Update the org.springframework.ws:spring-ws-security library and its related packages to version 4.1.4 or later.

See Also

https://github.com/advisories/GHSA-5x25-c2rf-f2jx

Plugin Details

Severity: Medium

ID: 446240

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/22/2026

Updated: 8/22/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-40997

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/11/2026

Vulnerability Publication Date: 6/11/2026

Reference Information

CVE: CVE-2026-40997

cwe: CWE-209